Search-UnifiedAuditLog for Sharepoint file and page activities dont match

809 Views Asked by At

I am trying to export audit logs for a particular Sharepoint site for the below operations and noticed that the count of records exported through PowerShell command "Search-UnifiedAuditLog" are much less than those downloaded through the browser Audit Log Search page. Any idea why I am seeing so much difference in logs?

https://compliance.microsoft.com/auditlogsearch?viewid=Test%20Tab Operations --> 'PageViewed','FileAccessed','FileDownloaded','SearchQueryPerformed'

1

There are 1 best solutions below

3
Julie_MSFT On

Per my test, I could not reproduce your issue, I use the following powershell to check related operations, and the results will not decrease.

Search-UnifiedAuditLog -StartDate "7/28/2021 12:00 AM" -EndDate "7/28/2021 6:00 AM" -Operations "FileAccessed","FileDownloaded","PageViewed","SearchQueryPerformed"

In addition, you could use the Office 365 Management Activity API to programmatically download data from the audit log.