Search-UnifiedAuditLog ConvertFrom-Json AuditData nested data

BlatniBPMCP 

I don't know if this will work or not: 

To Generate the Data

$ConvertAudit = Search-UnifiedAuditLog  -StartDate "04-01-2020" -EndDate "04-10-2020" -UserIds "user@domain.com" -ResultSize 5000

To produce the report:

$ConvertAudit | Select-Object -ExpandProperty AuditData | ConvertFrom-Json | Select-Object CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent

But the above is what I use to convert the JSON data to something that readable. Now I have yet to figure out how to expand multiple nested values within the same JSON Data Structure. 

Also, you might be able to use Excel and Select "PowerQuery" when importing data, using a transform. However its not easy to do and takes some effort, and doesnt always work. 

Thanks, 

Robert