Off the bat, I am rather new to developing PS scripts. I have to fetch the AuditLogs for a week relating to only 10 specific sites on a tenant(I have been able to do that) but now I saw somewhere that at one go, only around 5k records would be fetched using the Search-UnifiedAuditLog. So, I started checking on the net and stumbled upon your repository, and have incorporated the following code into my script-->
Do {
$currentResults = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations $FileAccessOperations -ResultSize 1000 -ObjectIds $Sites)
if ($currentResults.Count -gt 0) {
Write-Host (" Finished search #{1}, {2} records: {0} min" -f [math]::Round((New-TimeSpan -Start $scriptStart).TotalMinutes,4), $i, $FileAccessLog.Count)
# Accumulate the data
$FileAccessLog += $currentResults
# No need to do another query if the # recs returned <1k - should save around 5-10 sec per user
$currentResults.Count
if ($currentResults.Count -lt 1000) {
$currentResults = @()
} else {
$i++
}
}
} Until ($currentResults.Count -eq 0) # --- End of Session Search Loop --- #
Currently, I am testing this on my personal tenant where I only have around 20 audit log entries. I am checking this piece by modifying the result size to 5 and then checking the $currentResults.Count to be less than 5 instead of 1000, which is causing the loop to run indefinitely. Please suggest how should I be modifying the code! TIA
Off the bat, I am rather new to developing PS scripts. I have to fetch the AuditLogs for a week relating to only 10 specific sites on a tenant(I have been able to do that) but now I saw somewhere that at one go, only around 5k records would be fetched using the Search-UnifiedAuditLog. So, I started checking on the net and stumbled upon your repository, and have incorporated the following code into my script-->
Do {
$currentResults = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations $FileAccessOperations -ResultSize 1000 -ObjectIds $Sites)
if ($currentResults.Count -gt 0) {
Write-Host (" Finished search #{1}, {2} records: {0} min" -f [math]::Round((New-TimeSpan -Start $scriptStart).TotalMinutes,4), $i, $FileAccessLog.Count)
# Accumulate the data
$FileAccessLog += $currentResults
# No need to do another query if the # recs returned <1k - should save around 5-10 sec per user
$currentResults.Count
if ($currentResults.Count -lt 1000) {
$currentResults = @()
} else {
$i++
}
}
} Until ($currentResults.Count -eq 0) # --- End of Session Search Loop --- #
Currently, I am testing this on my personal tenant where I only have around 20 audit log entries. I am checking this piece by modifying the result size to 5 and then checking the $currentResults.Count to be less than 5 instead of 1000, which is causing the loop to run indefinitely. Please suggest how should I be modifying the code! TIA