Skip to content

Need some help with my code, where I have used a snippet of yours #1

Description

@TheSahil

Off the bat, I am rather new to developing PS scripts. I have to fetch the AuditLogs for a week relating to only 10 specific sites on a tenant(I have been able to do that) but now I saw somewhere that at one go, only around 5k records would be fetched using the Search-UnifiedAuditLog. So, I started checking on the net and stumbled upon your repository, and have incorporated the following code into my script-->

Do {
$currentResults = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations $FileAccessOperations -ResultSize 1000 -ObjectIds $Sites)
if ($currentResults.Count -gt 0) {
Write-Host (" Finished search #{1}, {2} records: {0} min" -f [math]::Round((New-TimeSpan -Start $scriptStart).TotalMinutes,4), $i, $FileAccessLog.Count)
# Accumulate the data
$FileAccessLog += $currentResults
# No need to do another query if the # recs returned <1k - should save around 5-10 sec per user
$currentResults.Count
if ($currentResults.Count -lt 1000) {
$currentResults = @()
} else {
$i++
}
}
} Until ($currentResults.Count -eq 0) # --- End of Session Search Loop --- #

Currently, I am testing this on my personal tenant where I only have around 20 audit log entries. I am checking this piece by modifying the result size to 5 and then checking the $currentResults.Count to be less than 5 instead of 1000, which is causing the loop to run indefinitely. Please suggest how should I be modifying the code! TIA

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions