functions/Get-SharePointActivityCount.ps1
|
function Get-SharePointActivityCount { <# .SYNOPSIS Gets count of a specific activity from SharePoint or OneDrive. .DESCRIPTION Gets count of a specific activity from SharePoint or OneDrive. .EXAMPLE #TODO: Add Example(s) PS C:\> <example usage> Explanation of what the example does .INPUTS #TODO: Add Inputs and outputs Inputs (if any) .OUTPUTS Output (if any) .NOTES #TODO: Add links to GitHub General notes #> [CmdletBinding()] param ( [Parameter()] $InputObject, [Parameter()] [string] $LAWId, [Parameter()] [string] $LAWKey ) begin { # Are we connected to exchange online? # Load TimeStamps from CSV. # If file does not exist, create it. $NewTimeStamp = Get-Date $LogAnalyticsWorkspaceParameters = @{ CustomerId = $LAWId SharedKey = $LAWKey TimeStampField = "CollectionTime" LogType = "ShellDemoCount_Test2" } } process { foreach ($entry in $InputObject) { # get last timestamp # if no timestamp, create first timestamp for the last 10 minutes if ([string]::IsNullOrEmpty($entry.LastTimeStamp)) { $entry.LastTimeStamp = ($NewTimeStamp).AddMinutes(-10) } else { $entry.LastTimeStamp = Get-Date -Date $entry.LastTimeStamp } $SearchUnifiedAuditLogParams = @{ StartDate = $entry.LastTimeStamp EndDate = $NewTimeStamp RecordType = 'SharePointFileOperation' Operations = $entry.Operation SessionCommand = 'ReturnLargeSet' UserIds = $entry.UserId } # get count of files $SearchResult = Search-UnifiedAuditLog @SearchUnifiedAuditLogParams $SearchResultCount = $SearchResult | ` Select-Object -ExpandProperty AuditData | ` ForEach-Object {$_ | ConvertFrom-Json} | ` Group-Object -Property Workload | ` Select-Object Name,Count # post to workspace foreach ($count in $SearchResultCount){ $LAWentry = [PSCustomObject]@{ CollectionTime = [System.DateTime]::UtcNow BeginTimeStamp = $entry.LastTimeStamp EndTimeStamp = $NewTimeStamp UserId = $entry.UserId Operation = $entry.Operation Workload = $count.Name Count = $count.Count } $LAWExportResult = Export-LogAnalytics @LogAnalyticsWorkspaceParameters $LAWentry if($LAWExportResult -ne "200") {throw "An error $LawExportResult ocurred while exporting to Log Analytics Workspace"} } [PSCustomObject]@{ UserId = $entry.UserId Operation = $entry.Operation LastTimeStamp = Get-Date -Date ($entry.LastTimeStamp) -Format o } # Old timestamp | new timestamp | URI | ActivityName | UserId | count of files # update timestamp } } end { # report final status / error information } } #TODO: Disconnect Exchange Online |