Forum Discussion
PowerShell script to export Audit log search Data based on userID filter
Office 365 Audit Log platform is helping you to monitor and control activities on your tenant.
In some case, it's necessary to export some user activity to detect some problematic usage.
FROM...
Fromelard I am trying to achieve a smoother and faster operation to query Compliance Portal get the Number of Files Deleted from One Drive for Business.
I am expecting approx >80K records deletion count in one day. Challenge I have is I am not sure on the exact count for 1 day or even 1 hour I am using below query
$Today = Get-Date -Date (Get-Date -Format “yyyy-MM-dd”)
$newStartDate = ($Today.AddDays(-$i)).AddHours($j)
$newEndDate = ($Today.AddDays(-$i)).AddHours($j + 1)
$deletedfiles = 1
do {
$deletedfiles = Search-UnifiedAuditLog -StartDate $newStartDate -EndDate $newEndDate -RecordType SharePointFileOperation -Operations FileDeleted -SessionId "$newStartDate" -SessionCommand ReturnLargeSet -Resultsize 5000 | Where-Object {$_.AuditData -like '*"Workload"' + ":" + '"OneDrive"*' }
Write-Host "Delete count: $($deletedfiles.Count)"
$dfiles += $deletedfiles
}
Until ($deletedfiles.Count -eq 0)Is it something you can suggest to speed up the slow query?
