How to Track Search Query Text in SharePoint Audit Logs
Question details
Users need to know how to retrieve or log the exact search query text entered by users in SharePoint, as the standard audit events no longer capture this information.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- Auditing user activity and tracking exact search terms entered by users within a SharePoint environment for compliance or analytics.
- Observed behavior
- The modern SearchQueryPerformed audit event only records that a search occurred, but does not store or display the actual query body text.
Ensure you have SharePoint administrator privileges and basic familiarity with Power Apps and SharePoint Lists to implement a custom search tracking form.
Create a Custom Search Form to Track Query Text
Since native audit logs no longer capture the query text, use a Power Apps form to log the user's search terms into a SharePoint list before executing the search.
Older SharePoint audit tools exposed detailed query information, but the current SearchQueryPerformed event omits the query body. To maintain compliance and audit records, administrators must build a custom tracking mechanism.
Set up a new SharePoint list with specific columns such as 'User', 'Search Query', and 'Timestamp' to store the tracked search data securely.
Design a simple search interface in Power Apps that functions as your users' primary search portal, replacing the default SharePoint search box.
Set the form's search button to use the 'Patch' function, saving the entered search keyword directly into your new SharePoint tracking list.
After the query is successfully logged, configure the application to navigate the user to the actual SharePoint search results page, passing the query parameter in the URL.
Periodically export your SharePoint list to Excel to analyze the captured search queries and fulfill your organization's compliance requirements.
Analyze Exported SharePoint Audit Logs with WPS Office
After exporting your custom SharePoint search query logs to Excel, you need a robust spreadsheet application to review the compliance data. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for auditing and reporting without the high subscription costs.
- 1. Download and Install WPS Office: Get the free WPS Office suite from the official website and complete the lightweight installation process.
- 2. Open Your Exported Log File: Launch WPS Spreadsheet and open the .xlsx or .csv file you exported from your SharePoint search tracking list.
- 3. Analyze Search Data: Use WPS Spreadsheet's built-in pivot tables and filtering tools to organize user queries and generate compliance reports.
Frequently Asked Questions
Why did older SharePoint versions show the search query text but modern logs do not?
Microsoft regularly updates its audit logging mechanisms for performance and privacy. While older Audit Log reports contained the query body, the modern SearchQueryPerformed event focuses solely on logging search occurrences rather than the specific data payloads.
Can I retrieve the search query body using PowerShell?
No, native PowerShell cmdlets querying the SearchQueryPerformed event will only return the metadata provided by the current audit log, which currently omits the exact query text.
Is there any native Microsoft 365 tool that shows what users are searching for?
You can view top search queries in the Microsoft Search usage reports within the Microsoft 365 admin center. However, this provides aggregated, anonymized search data rather than detailed, per-user compliance audit logs.
How do I export my custom SharePoint search list to Excel?
Navigate to your custom SharePoint list, click 'Export' in the top command bar, and select 'Export to Excel'. You can then open the downloaded file using a compatible spreadsheet application to analyze the logged search terms.
