I had a request to write a query that would show all messages that had been SMTP Forwarded.  The 'SMTP Forward' option is a specific setting within Retain that allows archived messages to be forwarded to another retention system.  See https://www.novell.com/documentation/retain-410/config-admin/data/svr-cf-scfg-modfwd-tab.html#svr-cf-scfg-modfwd-tab for additional information.  I am not a database administrator and there is probably a more elegant way to do this.  With some help, here is the query I came up with :

Select dt, targetUserid, f_first, f_last, f_email

FROM Audit

JOIN t_abook

ON action = 'sf';

This should return five columns of data.  The 'dt' column data will be the Unix timestamp.  The data can be imported into a spreadsheet application and the Unix timestamp column can be converted to a human readable format.  There is most likely a way to convert the Unix timestamp within the query itself, but I have not figured out how to do this.