Get-PowerBIActivityEvent retrieving different number of columns

[alexgor87]

While I was developing the script with Get-PowerBIActivityEvent I noticed that the same script might retrieve different results.
Here's the test: retrieving logs for the same day 7 times into 7 different CSV-files:

foreach ($i in 1..7) {
(Get-PowerBIActivityEvent -StartDateTime 2021-01-22T00:00:00 -EndDateTime 2021-01-22T23:59:59 -ResultType JsonString |
ConvertFrom-Json) | Select * |
Export-Csv -NoTypeInformation -Path "C:\Audit_Logs\PowerBI_AuditLog_$($i).csv"
}

Update: PowerShell version 5.1.18362.1171, MicrosoftPowerBIMgmt version 1.0.896.

The number of columns in the output files is different. For example, here's the comparison of the columns from the two files PowerBI_AuditLog_2.csv (417KB) and PowerBI_AuditLog_3.csv (444KB). Any ideas why this happens? Thanks

[alexgor87 · Accepted solution]

Thanks for reply @v-lionel-msft. I run the script for one user as you suggested and - yes, the number of columns for the single user can be different. My observations:
1. The sort order of the retrieved log records is always different.
2. Get-PowerBIActivityEvent returns Json string or object with the columns that have values (HasValues=True) only, which means it can return 17 columns or 28 depending on the particular log record.
3. After ConvertFrom-JSON and Export-CSV the output file structure is defined by the first exported record. Conclusion: considering that the sort order is always random - the file structure is always random too.

Is it possible to pre-define the output result structure before export, for example somewhere around 'SELECT * ' ?
Thanks

[alexgor87 · Accepted solution]

Update: for those who need a full list of Audit Log columns - this is what I figured out, hope it will help:

foreach ($i in 1..7) {
(Get-PowerBIActivityEvent -StartDateTime 2021-01-22T00:00:00 -EndDateTime 2021-01-22T23:59:59 -ResultType JsonString |
ConvertFrom-Json) |
Select Id, RecordType, CreationTime, Operation, OrganizationId, UserType, UserKey, Workload, UserId, ClientIP, UserAgent, Activity, ItemName, WorkSpaceName, DatasetName, ReportName, CapacityId, CapacityName, WorkspaceId, ObjectId, DataflowId, DataflowName, AppName, DataflowAccessTokenRequestParameters, DatasetId, ReportId, IsSuccess, DataflowType, ReportType, RequestId, ActivityId, AppReportId, DistributionMethod, ConsumptionMethod |
Export-Csv -NoTypeInformation -Path "C:\Audit_Logs\PowerBI_AuditLog_$($i).csv"
}

[v-lionel-msft]

Hi @alexgor87 ,

Yes, you can. Please refer to the sample.

Access the Power BI activity log 

Best regards,
Lionel Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[v-lionel-msft]

Hi @alexgor87 ,

So strange! Try to get the activity log of the specified user.

foreach ($i in 1..7) {
(Get-PowerBIActivityEvent -StartDateTime 2021-01-22T00:00:00 -EndDateTime 2021-01-22T23:59:59 -User admin@contoso.com -ResultType JsonString |
ConvertFrom-Json) | Select * |
Export-Csv -NoTypeInformation -Path "C:\Audit_Logs\PowerBI_AuditLog_$($i).csv"
}

Best regards,
Lionel Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[alexgor87 · Accepted solution]

Thanks for reply @v-lionel-msft. I run the script for one user as you suggested and - yes, the number of columns for the single user can be different. My observations:
1. The sort order of the retrieved log records is always different.
2. Get-PowerBIActivityEvent returns Json string or object with the columns that have values (HasValues=True) only, which means it can return 17 columns or 28 depending on the particular log record.
3. After ConvertFrom-JSON and Export-CSV the output file structure is defined by the first exported record. Conclusion: considering that the sort order is always random - the file structure is always random too.

Is it possible to pre-define the output result structure before export, for example somewhere around 'SELECT * ' ?
Thanks