Office Activity Visualize Downloadsvs Uploads

//Visualize uploads vs downloads in your Office 365 tenant per day //Data connector required for this query - Office 365 OfficeActivity | where TimeGenerated > ago(30d) | project TimeGenerated, Operation | where Operation in ("FileSyncDownloadedFull", "FileSyncUploadedFull", "FileDownloaded", "FileUploaded") | summarize ['Files Downloaded']=countif(Operation in ("FileDownloaded", "FileSyncDownloadedFull")), ['Files Uploaded']=countif(Operation in ("FileSyncUploadedFull", "FileUploaded")) by startofday(TimeGenerated) | render columnchart with ( kind=unstacked, title="Downloads vs Uploads in Office 365", ytitle="Count", xtitle="Day")

Explanation

This query visualizes the number of file uploads and downloads in your Office 365 tenant per day. It uses the Office 365 data connector and retrieves data from the OfficeActivity table. The query filters the data for the past 30 days and selects the TimeGenerated and Operation columns. It then counts the number of files downloaded and uploaded using specific operation types. The results are summarized by the start of each day and rendered as a column chart, with the count of downloads and uploads on the y-axis and the day on the x-axis. The chart is titled "Downloads vs Uploads in Office 365" and the y-axis is labeled "Count" while the x-axis is labeled "Day".

Details

Matt Zorich

Released: June 17, 2022

Tables

OfficeActivity

Keywords

OfficeActivity,TimeGenerated,Operation,FileSyncDownloadedFull,FileSyncUploadedFull,FileDownloaded,FileUploaded,FilesDownloaded,FilesUploaded,startofday,render,columnchart,kind,title,ytitle,xtitle,Day

Operators

whereprojectsummarizecountifbyrender

KQL Search