Forum Discussion
Microsoft Purview missing logs
Try without scoping the results to a site also, just for the sake of testing. If you are not seeing anything, you'll have to work with support I'm afraid.
Thanks Vasil,
I conducted a search using the RecordType "SharePointListOperation" without scoping the results to a specific site, and it returned "Updated list" results across the entire site collection.
Similarly, a search using the activity "listcolumndeleted" without scoping the results to a specific site returned "Deleted list column" results across the site collection.
Could you please confirm if this is the correct method to retrieve SharePoint audit logs from Microsoft Purview? Alternatively, could this issue be related to the Microsoft Purview configuration?
There's nothing to configure, different event types expose different metadata/identifiers, so you might need some error/trial to find the correct approach, depending on the event. This is why I suggested to go with a broader search, not only you can confirm the events are captured, but see what identifier shows in there, so you know how to properly conduct a more targeted search. If you cannot find a better way to scope the search, you can use the -FreeText parameter as a last resort (but that's only exposed via the cmdlet).