More in-depth reporting on Team sites

And here's some PowerShell to report the number of accesses to documents in a particular site over a 3-month period.

$SiteId = "acfe74d8-edfb-436d-924b-e018666605ee"
$Records = (Search-UnifiedAuditLog -StartDate 1-Feb-2018 -EndDate 1-May-2018 -Operations FileAccessed -ResultSize 2000 -SiteIds $SiteId)
If ($Records.Count -eq 0) {
   Write-Host "No SharePoint file access records found." }
 Else {
   Write-Host "Processing" $Records.Count " SharePoint file access audit records..."
   $Report = @()
   ForEach ($Rec in $Records) {
      $AuditData = ConvertFrom-Json $Rec.Auditdata
      If ($AuditData.SourceFileName -NotLike "*aspx*" -And $AuditData.SourceFileName -NotLike "*jpg*" ) {
         $ReportLine = [PSCustomObject][Ordered]@{
           TimeStamp   = $AuditData.CreationTime
           User        = $Rec.UserIds
           Action      = $AuditData.Operation
           Workload    = $AuditData.Workload
           URL         = $AuditData.SiteUrl
           Document    = $AuditData.SourceFileName }      
        $Report += $ReportLine }
      }
}

$GroupData = $Report | Group-Object -Property Document
$GroupData | Sort Count -Desc | Select Name, Count

The key thing here is to know the site identifier (GUID) for the site you want to analyze. One way to get this is to run an audit search for FileAccessed events and select one that matches the site to analyze. If you look at the extended audit event properties, you see a site id like the one shown in the code.

After that. it's just a matter of grabbing the audit events, filtering them, and the grouping and reporting the file names. You get something like this:

Name                                                                                                 Count
----                                                                                                 -----
Ch 16 - Office 365 Apps.docx                                                                           167
Updates to the Fourth Edition.docx                                                                     132
HoldInfo.Xml                                                                                           130
Ch 15 - Managing Office 365 Groups.docx                                                                123
Ch 3 - Office 365 Basic Workloads.docx                                                                  55
Ch 14 - Office 365 Groups.docx                                                                          49
Ch 20 - Reporting and Auditing.docx                                                                     46

The code to analyze audit events is taken from Chapter 20 of Office 365 for IT Pros (https://gum.co/O365IT)