Forum Discussion
Searching Audit log Strange Behavior
- Just thought I would give you an update on the response I got back from Microsoft Support.
"When the ResultCount is 0 or ResultIndex is -1, the search faced internal timeout.
Please ignore the results returned when the internal timeout occurs, and (wait 5 minutes then) try search again."
Pretty generic response but oh well.
I found this thread by chance and I too have noticed duplicate records when exporting an audit log search into a spreadsheet
On a separate cheeky note, I want to monitor User creation, modification and deletion of Microsoft Teams and as I'm not familiar with building scripts I was wondering if you might share your script that loads audit log records into a csv file ?
- Frank
Well its June 2022 and I am seeing the same issue with duplicate results. I implemented a simple while loop to check for it and repeat the run until the data is good. I set a max of 10 loops, but I have noticed that the data is OK on the 2nd query (but not always!).
#Attempt 1.
$AuditResults = Search-UnifiedAuditLog -StartDate $startOfMonth -EndDate $endOfMonth -SessionCommand ReturnLargeSet -resultsize 1000 -Operations FileDownloaded -SiteID "<Insert Site ID>" -FreeText Certification
#Additional Attempts
if ( $AuditResults.Count -gt 0 )
{
#We have some results. Check if the data is good.
while($AuditResults[0].ResultIndex -eq -1)
{
$AuditResults = Search-UnifiedAuditLog -StartDate $startOfMonth -EndDate $endOfMonth -SessionCommand ReturnLargeSet -resultsize 1000 -Operations FileDownloaded -SiteID "<insertSiteID>" -FreeText Certification
$loop++
#Prevent an infinite or very high loop by setting a max. of 10 iterations.
if($loop -gt 10) {
break
}
}
}