Forum Discussion
Solved
Search-UnifiedAuditLog limitation on number of results
Hi, I need to extract PowerBI audit logs in order to get some valuable information. So, I'm using Search-UnifiedAuditLog command, which according to the documentation could parse 50.000 records. B...
- The variable is getting overwritten at every "page", so on each append, new results are added (usorted!) The cycle will run until the "last" page is returned, which should contain 0 entries, thus invalidating the condition.
The example above works fine in my tenant, I fetched 30k+ records with it, with no duplication at least according to Excel 🙂
The only thing I changed was to remove the RecordType, as I don't have that many events in my personal tenant.
Hi,
Just tried your code, but in fact it's creating the same records over and over again.
When I stopped the process my csv had already 1Gb, and when I opened it there where dozens of similar records, so it's storing the same data over and over again.
Shouldn't the $AuditOutput variable be cleared at some point? What it seems is that it's storing all the information that comes out from the "Search-UnifiedAuditLog" command.
The variable is getting overwritten at every "page", so on each append, new results are added (usorted!) The cycle will run until the "last" page is returned, which should contain 0 entries, thus invalidating the condition.
The example above works fine in my tenant, I fetched 30k+ records with it, with no duplication at least according to Excel 🙂
The only thing I changed was to remove the RecordType, as I don't have that many events in my personal tenant.
The example above works fine in my tenant, I fetched 30k+ records with it, with no duplication at least according to Excel 🙂
The only thing I changed was to remove the RecordType, as I don't have that many events in my personal tenant.
I have issues with it. This is my script. And it loads the same 5k data over and over again. Could you please confirm that this still working well on your side?
I tried on ExchangeOnlineManagement versions 3.0.0, 3.3.0, 3.7.0. Result is the same
$AuditOutput = @() do { Write-Host "Searching for Power BI audit records..." $AuditOutput = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -SessionId "Test" -SessionCommand ReturnLargeSet -RecordType PowerBIAudit -ResultSize 5000 $AuditOutput | Export-Csv -Path "/home/bohdankov/AuditLog.csv" -NoTypeInformation -Append } while ($AuditOutput)- Hi,
Thanks for the help, I was able to fix it.- How did you fix this issue?
