0

I'm currently working through a csv of Sharepoint AuditData and trying to evaluate several fields that are nested in the audit data field. I've tried all the Usual $_.AuditData.CreatedDate etc. but can't figure out how to query the data thats nested in it. It's my first time trying to evaluate against data thats structured like this and any help about how best to go about this would be very much appreciated.

I've tried the where object clause and its not returning the data I would expect

"PSComputerName","RunspaceId","PSShowComputerName","RecordType","CreationDate","UserIds","Operations","AuditData","ResultIndex","ResultCount","Identity","IsValid","ObjectState"
"REDACTED","REDACTED","REDACTED","REDACTED","REDACTED","REDACTED","REDACTED","{""AppAccessContext"":{""AADSessionId"":""REDACTED"",""CorrelationId"":""REDACTED"",""TokenIssuedAtTime"":""REDACTED"",""UniqueTokenId"":""REDACTED""},""CreationTime"":""REDACTED"",""Id"":""REDACTED"",""Operation"":""REDACTED"",""OrganizationId"":""REDACTED"",""RecordType""REDACTED""UserKey"":""REDACTED"",""UserType""REDACTED""Version""REDACTED""Workload"":""REDACTED"",""ClientIP"":""REDACTED"",""ObjectId"":""REDACTED"",""UserId"":""REDACTED"",""CorrelationId"":""REDACTED"",""EventSource"":""REDACTED"",""ItemType"":""REDACTED""",""ListId"":""REDACTED"",""ListItemUniqueId"":""REDACTED"",""Site"":""REDACTED"",""UserAgent"":""REDACTED"",""WebId"":"REDACTED"",""MachineId"":""REDACTED"",""FileSyncBytesCommitted"":""REDACTED"",""HighPriorityMediaProcessing""REDACTED""ImplicitShare"":""REDACTED"",""IsManagedDevice""REDACTED""SourceFileExtension"":""REDACTED"",""SiteUrl"":""REDACTED"",""SourceFileName"":""REDACTED"",""SourceRelativeUrl"":""REDACTED""}","REDACTED","REDACTED","REDACTED","REDACTED","REDACTED"
Leighton Morris
  • 26
  • 2
  • 2
    Please add a sanitized sample of the CSV and specify what the expected outcome should be. – zett42 Dec 20 '22 at 10:25
  • "*csv of Sharepoint AuditData*". `Csv` ([Comma-separated values](https://en.wikipedia.org/wiki/Comma-separated_values)) data is flat by design. Anyways, to find the members (properties) of your `$AuditData`, try: `$AuditData |Get-Member`, or to see the whole structure: `$AuditData |ConvertTo-Json -Depth 5`. – iRon Dec 20 '22 at 10:52
  • Show us the CSV :) – Mathias R. Jessen Dec 20 '22 at 11:01
  • Sorry i'm not sure how to upload the csv file so i've added the sanitized csv as a code snippet, It's fields inside the audit data field i'm trying to evaluate such as operation, record type etc. Thank you all for you quick responses – Leighton Morris Dec 20 '22 at 11:05
  • 3
    Aha, so it's JSON! Use `$_.AuditData |ConvertFrom-Json` to parse the embedded data – Mathias R. Jessen Dec 20 '22 at 11:10
  • Boom and just like that I can play with the data, thank you so much! – Leighton Morris Dec 20 '22 at 11:26

0 Answers0