We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Search-UnifiedAuditLog will only return 50k items. If the search gets back >50k items we have two issues:
The text was updated successfully, but these errors were encountered:
Could you use something like the example script at this url (https://blogs.msdn.microsoft.com/tehnoonr/2018/01/26/retrieving-office-365-audit-data-using-powershell/) to pull down the Unified Audit Log in 15 minute chunks?
Or start with 60 minute chunks and if the query produces > 5,000 results reduce the time slice further to help optimise the pull.
I hacked at the above script and managed to pull down 1.2GB worth of Unified Audit Log for a tenancy before it finally crapped out.
Sorry, something went wrong.
Does Robust Cloud Command help against this restriction?
No branches or pull requests
Search-UnifiedAuditLog will only return 50k items. If the search gets back >50k items we have two issues:
The text was updated successfully, but these errors were encountered: