Your audit export file contains a list of events for the given time period.

TimestampThe timestamp of when the event file was exported.  This value also contains the CEF version, which is always CEF:0.
Anaplan identifierThis is always Anaplan, Inc.
HostnameIf present, this indicates the hostname for the machine from which the event originated.
Service versionThe version of the Anaplan service generating the log, if present.
Event codeThe Anaplan code associated with the audit event.  For example, USR-8.
Event messageThe brief descriptive audit event message associated with the event code.  For example user login success.
Additional details

The additional details associated with the audit event can include:

id - a unique identifier for the event entry.

userId - the user ID associated with the audit event.

tenantId - the ID for the tenant associated with the audit event.

eventTimeZone - the time zone where the audit event took place and its coordinated universal time (UTC). 

createdDate - the timestamp for the date the event was created.

createdTimeZone - the time zone the audit event was created in.

success - a true value indicates the event was successful.  A false value indicates the event was a failed attempt.

objectId - the ID for the object related to the audit event.  This varies by event. For details on the related object ID, review the list of tracked audit events.

ipAddress - the associated IP address for the audit event.

userAgent - the device used to generate the audit event.

checksum - the checksum associated with the audit event.

Tracked audit events

Anaplan tracked audit events list by the filter category in Audit:

Example

2021-05-03T22:28:12.000Z  CEF:0|Anaplan, Inc.|||USR-8|User login success|id={ID} userId={user ID} tenantId={tenant ID} eventTimeZone=UTC createdDate=1620080893000 createdTimeZone=UTC success={true or false} objectId={associated user ID} ipAddress={IP address} userAgent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 checksum={checksum}

2021-05-04T08:33:04.000Z  CEF:0|Anaplan, Inc.|||USR-1|User created|id=1389498298478657536 userId={ID} tenantId={tenant ID} eventTimeZone=UTC createdDate=1620117185000 createdTimeZone=UTC success={true or false} objectId={ID of the created user} ipAddress=127.0.0.1 userAgent=userAgent checksum={checksum}