Office 365 Management Activity API - Audit.SharePoint returns event out of the time frame
up vote
0
down vote
favorite
I'm working against the Office 365 Management Activity API and trying to get system events for a time frame. e.g. I want to get create folder events between 2018-11-21T16:58:43.4970000Z and 2018-11-21T16:58:46.5407833Z.
I'm sending this request first:
https://manage.office.com/api/v1.0/1111/activity/feed/subscriptions/content?contentType=Audit.Sharepoint&startTime=2018-11-21T16:58:43.4970000Z&endTime=2018-11-21T16:58:46.5407833Z&PublisherIdentifier=11111
and based on the response I send the second request:
https://manage.office.com/api/v1.0/11111/activity/feed/audit/20181121165257926082320$20181121165843497120740$audit_sharepoint$Audit_Sharepoint?PublisherIdentifier=11111
I get event list in the response. The problem is that I get events with creation time which is earlier then I defined in the requests (2018-11-21T16:55:09):
{"CreationTime":"2018-11-21T16:55:09","Id":"*****","Operation":"FolderCreated","OrganizationId":"********","RecordType":6,"UserKey":"i:0h.f|membership|******@live.com","UserType":0,"Version":1,"Workload":"OneDrive","ClientIP":"******","ObjectId":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/Documents/am1/amir444","UserId":"admin@501.blabla.com","CorrelationId":"******","EventSource":"SharePoint","ItemType":"Folder","ListId":"49fc3d8e-5345-4225-867f-451a753331eb","ListItemUniqueId":"b15f342b-5812-4ad9-9077-ce5c5454c4b1","Site":"014fe483-77db-4234-9245-fa144534d88fa","UserAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36","WebId":"be54eb7-0f23-45bc-8540-389fbed45359","SourceFileExtension":"","SiteUrl":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/","SourceFileName":"amir444","SourceRelativeUrl":"Documents/am1"}
The strange thing is that every event (e.g. "FolderCreated") I'm getting twice. One in the correct time frame and the second when another event is created, even if the start time I'm defining is much bigger than the original event creation time...
sharepoint onedrive office365api
asked Nov 22 at 11:53
Amir M
1431314
add a comment |
up vote
0
down vote
favorite
I'm working against the Office 365 Management Activity API and trying to get system events for a time frame. e.g. I want to get create folder events between 2018-11-21T16:58:43.4970000Z and 2018-11-21T16:58:46.5407833Z.
I'm sending this request first:
https://manage.office.com/api/v1.0/1111/activity/feed/subscriptions/content?contentType=Audit.Sharepoint&startTime=2018-11-21T16:58:43.4970000Z&endTime=2018-11-21T16:58:46.5407833Z&PublisherIdentifier=11111
and based on the response I send the second request:
https://manage.office.com/api/v1.0/11111/activity/feed/audit/20181121165257926082320$20181121165843497120740$audit_sharepoint$Audit_Sharepoint?PublisherIdentifier=11111
I get event list in the response. The problem is that I get events with creation time which is earlier then I defined in the requests (2018-11-21T16:55:09):
{"CreationTime":"2018-11-21T16:55:09","Id":"*****","Operation":"FolderCreated","OrganizationId":"********","RecordType":6,"UserKey":"i:0h.f|membership|******@live.com","UserType":0,"Version":1,"Workload":"OneDrive","ClientIP":"******","ObjectId":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/Documents/am1/amir444","UserId":"admin@501.blabla.com","CorrelationId":"******","EventSource":"SharePoint","ItemType":"Folder","ListId":"49fc3d8e-5345-4225-867f-451a753331eb","ListItemUniqueId":"b15f342b-5812-4ad9-9077-ce5c5454c4b1","Site":"014fe483-77db-4234-9245-fa144534d88fa","UserAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36","WebId":"be54eb7-0f23-45bc-8540-389fbed45359","SourceFileExtension":"","SiteUrl":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/","SourceFileName":"amir444","SourceRelativeUrl":"Documents/am1"}
The strange thing is that every event (e.g. "FolderCreated") I'm getting twice. One in the correct time frame and the second when another event is created, even if the start time I'm defining is much bigger than the original event creation time...
sharepoint onedrive office365api
asked Nov 22 at 11:53
Amir M
1431314
What is the question?
– Luke Walker
Nov 22 at 12:16
1
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I'm working against the Office 365 Management Activity API and trying to get system events for a time frame. e.g. I want to get create folder events between 2018-11-21T16:58:43.4970000Z and 2018-11-21T16:58:46.5407833Z.
I'm sending this request first:
https://manage.office.com/api/v1.0/1111/activity/feed/subscriptions/content?contentType=Audit.Sharepoint&startTime=2018-11-21T16:58:43.4970000Z&endTime=2018-11-21T16:58:46.5407833Z&PublisherIdentifier=11111
and based on the response I send the second request:
https://manage.office.com/api/v1.0/11111/activity/feed/audit/20181121165257926082320$20181121165843497120740$audit_sharepoint$Audit_Sharepoint?PublisherIdentifier=11111
I get event list in the response. The problem is that I get events with creation time which is earlier then I defined in the requests (2018-11-21T16:55:09):
{"CreationTime":"2018-11-21T16:55:09","Id":"*****","Operation":"FolderCreated","OrganizationId":"********","RecordType":6,"UserKey":"i:0h.f|membership|******@live.com","UserType":0,"Version":1,"Workload":"OneDrive","ClientIP":"******","ObjectId":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/Documents/am1/amir444","UserId":"admin@501.blabla.com","CorrelationId":"******","EventSource":"SharePoint","ItemType":"Folder","ListId":"49fc3d8e-5345-4225-867f-451a753331eb","ListItemUniqueId":"b15f342b-5812-4ad9-9077-ce5c5454c4b1","Site":"014fe483-77db-4234-9245-fa144534d88fa","UserAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36","WebId":"be54eb7-0f23-45bc-8540-389fbed45359","SourceFileExtension":"","SiteUrl":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/","SourceFileName":"amir444","SourceRelativeUrl":"Documents/am1"}
The strange thing is that every event (e.g. "FolderCreated") I'm getting twice. One in the correct time frame and the second when another event is created, even if the start time I'm defining is much bigger than the original event creation time...
sharepoint onedrive office365api
asked Nov 22 at 11:53
Amir M
1431314
I'm working against the Office 365 Management Activity API and trying to get system events for a time frame. e.g. I want to get create folder events between 2018-11-21T16:58:43.4970000Z and 2018-11-21T16:58:46.5407833Z.
I'm sending this request first:
https://manage.office.com/api/v1.0/1111/activity/feed/subscriptions/content?contentType=Audit.Sharepoint&startTime=2018-11-21T16:58:43.4970000Z&endTime=2018-11-21T16:58:46.5407833Z&PublisherIdentifier=11111
and based on the response I send the second request:
https://manage.office.com/api/v1.0/11111/activity/feed/audit/20181121165257926082320$20181121165843497120740$audit_sharepoint$Audit_Sharepoint?PublisherIdentifier=11111
I get event list in the response. The problem is that I get events with creation time which is earlier then I defined in the requests (2018-11-21T16:55:09):
{"CreationTime":"2018-11-21T16:55:09","Id":"*****","Operation":"FolderCreated","OrganizationId":"********","RecordType":6,"UserKey":"i:0h.f|membership|******@live.com","UserType":0,"Version":1,"Workload":"OneDrive","ClientIP":"******","ObjectId":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/Documents/am1/amir444","UserId":"admin@501.blabla.com","CorrelationId":"******","EventSource":"SharePoint","ItemType":"Folder","ListId":"49fc3d8e-5345-4225-867f-451a753331eb","ListItemUniqueId":"b15f342b-5812-4ad9-9077-ce5c5454c4b1","Site":"014fe483-77db-4234-9245-fa144534d88fa","UserAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36","WebId":"be54eb7-0f23-45bc-8540-389fbed45359","SourceFileExtension":"","SiteUrl":"https://spenterprise501-my.sharepoint.com/personal/admin_501_blabla_com/","SourceFileName":"amir444","SourceRelativeUrl":"Documents/am1"}
The strange thing is that every event (e.g. "FolderCreated") I'm getting twice. One in the correct time frame and the second when another event is created, even if the start time I'm defining is much bigger than the original event creation time...
sharepoint onedrive office365api
sharepoint onedrive office365api
asked Nov 22 at 11:53
Amir M
1431314
asked Nov 22 at 11:53
Amir M
1431314
edited Nov 25 at 8:13
asked Nov 22 at 11:53
Amir M
1431314
asked Nov 22 at 11:53
Amir M
1431314
asked Nov 22 at 11:53
Amir M
1431314
1431314
What is the question?
– Luke Walker
Nov 22 at 12:16
1
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41
add a comment |
What is the question?
– Luke Walker
Nov 22 at 12:16
1
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41
What is the question?
– Luke Walker
Nov 22 at 12:16
What is the question?
– Luke Walker
Nov 22 at 12:16
1
1
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53430449%2foffice-365-management-activity-api-audit-sharepoint-returns-event-out-of-the-t%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What is the question?
– Luke Walker
Nov 22 at 12:16
1
Why do I get in the bucket event with creation time that is earlier than the bucket start time. And why do I get this event twice in two separate buckets - once in a "correct" bucket and the second in the wrong one.
– Amir M
Nov 22 at 12:41