How can I get Membership information?

[risingflight143]

Hi All

i have an unified group(i.e office365 unified group) created from Office365.  i want to know membership details i.e who has added/removed users to this group. This group will also be visible in Azure AD. i can check audit logs in Azure AD and it shows only for a month. i am trying below splunk query to fetch membership information from both Azure AD and office365 but i am not getting output. ug@contoso.com is my group  name

sourcetype=azure*:management:activity (Operation="*Change user*" OR Operation="*Update user*") ObjectId="*ug@contoso.com*" (UserId!="Certificate" AND UserId!="ServicePrincipal*" AND UserId!="Sync*") (ModifiedProperties{}.NewValue!=" " AND ModifiedProperties{}.OldValue!=" ")
| rename ModifiedProperties{}.NewValue AS ModAdd
| rename ModifiedProperties{}.OldValue AS ModRem
| rename UserId AS "Actioned By" 
| rename Operation AS "Action" 
| rename ObjectId AS "Member"
| sort -_time 
| table _time, ModAdd, ModRem, "Action", Member, "Actioned By"

[yuanliu]

To obtain help from volunteers, you will first need to post sample data (anonymize as needed) that can support your belief that the search should return output.  If the logic is not obvious, you also need to explain your logic between raw data and your expected output.