Get items modified in last 24 hours from Site collection

Question

• I would like to have the report of items modified in last 24 hours from site collection
• Could anyone suggest me the best approach to hang with it either by going with SPaudit or with SPSiteDataQuery to get detail information and how can i do it.

Answer 1

You can do this with search and PowerShell as follows:

#Use Nuget to to get the latest CSOM dlls.
Add-Type -Path "c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
Add-Type -Path "c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Search.dll"
$pass = Read-Host -Prompt "Password:" -AsSecureString
$user = "youruser@some-tenant.onmicrosoft.com"
$creds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($user, $pass) 
$url = "https://some-tenant.sharepoint.com"
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($url) 
$ctx.Credentials = $creds

function Get-SearchResults {
    param (
        [string]$query
    )
    $keyWordQry = New-Object Microsoft.SharePoint.Client.Search.Query.KeywordQuery($ctx)
    $keyWordQry.TrimDuplicates = $false
    $keyWordQry.EnableStemming = $false
    $keyWordQry.QueryText = $query
    $searchExec = New-Object Microsoft.SharePoint.Client.Search.Query.SearchExecutor($ctx)
    $results = $searchExec.ExecuteQuery($keyWordQry)
    $ctx.ExecuteQuery()
    Write-Output $results
}
$query = "Write>=" + (Get-date).AddDays(-1).ToString("dd/MM/yyyy")
#This returns a generic list that you can filter to get the results you need.
#In this instance just the path of the modified object is being returned.
$srchRes = Get-SearchResults -query $query 
$srchRes.Value[0].ResultRows | % {$_["Path"]}

This is a basic example to get you started but you should consider paging the search results before you use this regularly. You do that by specifying a startrow and a rowlimit property for the KeywordQuery object.

Answer 2

You can try the following script :

$dir_to_look="D:\TestFolder"    
$month_backdate=$(Get-Date).AddDays(-1)    
Get-Childitem $dir_to_look -Recurse | where-object {!($_.psiscontainer)} | where { $_.LastWriteTime -gt $month_backdate } | foreach {  Write-Host "$($_.LastWriteTime) :: $($_.Fullname) "  } | export-csv -path \\share\filename.csv

or

function Get-OldFiles {
 param($date)
 $folders = get-childitem “D:\TestFolder” -recurse | Where-Object {$_.psIsContainer -eq $true}
 foreach ($folder in $folders) {
     $oldfiles = Dir $folder.fullname *.* | where-object {$_.LastWriteTime -le $date}
     if ($oldfiles.count) {
         [float]$totalsize = ($oldfiles | Measure-Object -Sum length).Sum / 1KB
         $data = @{‘Folder’=$folder.fullname;’Count’=$oldfiles.count;’Size(Kb)’=$totalsize}
        New-Object -Type PSObject -Prop $data
        }
    }
}
Get-OldFiles ’dd/mm/yyyy′ | Export-CSV \\sharename\file.csv -NoTypeInformation

Alternatively, you may try this automated solution which assists you to accomplish this tasks.