On the Home tab, select Close & Load to close the Power Query Editor and open the transformed CSV file in an Excel workbook. In Excel, cells with null values are empty. If the property doesn't contain a value, the null value is displayed. Each row in the column contains the value for the property. Each new column corresponds to a property in the AuditData JSON object. The AuditData column is split into multiple columns. Leave the Use original column name as prefix checkbox selected to add the AuditData prefix to the column names for example, AuditData.RecordType or AuditData.SourceFileName.Unselect the Use original column name as prefix checkbox to use the name of the JSON property as the column names for example, RecordType or SourceFileName.From there it will be a record and you can click the Expand icon in the upper right corner of the column, view the attributes, and select the one you want to view or extract.ĭo one of the following things to format the title of the columns that are added for each JSON property that's selected. To view an attribute within a list such as AuditData.AffectedItems, click the Expand icon in the upper right corner of the column you want to pull an attribute from, and then select Expand to New Row. Eliminating columns that aren't useful for your investigation is a good way to reduce the amount of data displayed in the audit log. You can unselect the checkbox next to any property that you don't want to include. Select Load more to display all properties in the JSON objects in the AuditData column.
In the upper-right corner of the AuditData column, select the expand icon.Ī partial list of the properties in the JSON objects in the AuditData column is displayed. Right-click the title in the AuditData column, select Transform, and then select JSON. The next step is to create a column for each property in the JSON object. The AuditData column is a JSON object that contains multiple properties. There are four columns: CreationDate, UserIds, Operations, and AuditData. The CSV file is opened in the Query Editor. In the window that's displayed, select Transform Data. Open the CSV file that you downloaded in Step 1.
On the Data tab, in the Get & Transform Data ribbon group, select From Text/CSV. Open a blank workbook in Excel for Office 365, Excel 2019, or Excel 2016. This can help you quickly locate the specific auditing data you're looking for. Then you filter columns to view records based on the values of specific properties. The next step is to use the JSON transform feature in the Power Query Editor in Excel to split each property in the JSON object in the AuditData column into its own column. Step 2: Format the exported audit log using the Power Query Editor You might have to run multiple searches with smaller date ranges to export more than 50,000 entries. To export more than this limit, try using a narrower date range to reduce the number of audit log records. If 50,000 entries are downloaded to the CSV file, you can probably assume there are more than 50,000 events that met the search criteria.
#Exchange online admin audit log download
You can download a maximum of 50,000 entries to a CSV file from a single audit log search. You can also access the CSV file in the Downloads folder. Large files will result when searching for all activities or using a wide date range.Īfter the export process is complete, a message is displayed at the top of the window that prompts you to open the CSV file and save it to your local computer. It takes a while to prepare the download file for a large search.
This option exports all the audit records from the audit log search you ran in step 1, and adds the raw data from the audit log to a CSV file. On the search results page, select Export. Run an audit log search and revise the search criteria if necessary until you have the desired results. The first step is to search the audit log and then export the results in a comma-separated value (CSV) file to your local computer.
#Exchange online admin audit log trial
Learn details about signing up and trial terms. Start now at the Microsoft Purview compliance portal trials hub. If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs.
0 kommentar(er)
