Views:

Learn how to format your queries for SharePoint and OneDrive file upload events.

Suggested search method and field/value pairs

  • Search method: Email and Collaboration Activity Data
  • eventName: COLLABORATION_ACTIVITY
  • productCode: xca
  • service: SharePoint OR service: OneDrive
  • actionName: fileUploaded
    Note
    Note
    For more information about Microsoft actions (operations), see Audit log activities.

Important fields in search results

  • target: The full path name of the file accessed by the user.
  • principalName: The user principal name of the user who performed the action.
  • eventTime: The time of the file upload event.