Skip to content
This repository has been archived by the owner on Dec 27, 2022. It is now read-only.

Issue while running sparrow.ps1 #68

Closed
Vinod-o365 opened this issue Apr 16, 2021 · 1 comment
Closed

Issue while running sparrow.ps1 #68

Vinod-o365 opened this issue Apr 16, 2021 · 1 comment
Assignees
Labels
question This issue is a request for information or needs discussion

Comments

@Vinod-o365
Copy link

Hi Team,
We are getting warning : Result set may have been truncated; narrow start/end date

@genericdevname genericdevname added the question This issue is a request for information or needs discussion label Apr 16, 2021
@genericdevname genericdevname self-assigned this Apr 16, 2021
@genericdevname
Copy link
Collaborator

genericdevname commented Apr 16, 2021

Hello,

The warning message is alerting you that there were 5000 entries returned, which is the maximum amount of results that Search-UnifiedAuditLog will return.

If you modify the following code (lines 7 and 9), you will be able to return results that are more narrow. If you wanted to attempt to capture all the results, you will have to run the script multiple times with different date ranges:

    [Parameter()]
    [datetime] $StartDate = [DateTime]::UtcNow.AddDays(-364),
    [Parameter()]
    [datetime] $EndDate = [DateTime]::UtcNow,

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
question This issue is a request for information or needs discussion
Projects
None yet
Development

No branches or pull requests

2 participants