Forum Discussion
Obtain Deleted Stats (SharePoint) by Retention Policy
I've scoured: https://learn.microsoft.com/en-us/purview/retention-cmdlets and the Unified Audit Log (https://www.meetingroom365.com/blog/search-unifiedauditlog-powershell/, https://theitbros.com/quer...
How about using the Search-UnifiedAuditLog cmdlet to query audit logs for deletion events? It can help to filter out by date range and action type (e.g., "FileDeleted") to identify files deleted by the retention policy. This might give you a count of deleted files, though it won't directly provide storage statistics.
I've begun that path. Is there a Search query you could suggest?
Any idea what parameters would be used to filter for only SharePoint sites?
The search I used previously also seems to include OneDrive deletions.
Referenced as "ObjectId":"https://domain-my.sharepoint.com/personal/user_name_domain_com/personal/user_name_domain_com/Lists/PersonalCacheLibrary/WebPartCache/ffcd3017-1840-48bc-a436-d650s14590ea.txt"}