Forum Discussion
Search-UnifiedAuditLog ConvertFrom-Json AuditData nested data
I don't know if this will work or not:
To Generate the Data
$ConvertAudit = Search-UnifiedAuditLog -StartDate "04-01-2020" -EndDate "04-10-2020" -UserIds "user@domain.com" -ResultSize 5000
To produce the report:
$ConvertAudit | Select-Object -ExpandProperty AuditData | ConvertFrom-Json | Select-Object CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent
But the above is what I use to convert the JSON data to something that readable. Now I have yet to figure out how to expand multiple nested values within the same JSON Data Structure.
Also, you might be able to use Excel and Select "PowerQuery" when importing data, using a transform. However its not easy to do and takes some effort, and doesnt always work.
Thanks,
Robert