not getting output

[risingflight143]

Hi All I am using Office365,  i have an office365 unified group and users are getting removed from this office365 group automatically everyday.  I want to get the data who has removed or added the users to this group. When i use the below query, I am not getting any output please guide me. Lets say my group name is MyGroup1 and its email address is [email protected]

sourcetype=o365:management:activity (Operation="*group*") unifiedgroup="*MyGroup1*"
| rename ModifiedProperties{}.NewValue AS ModAdd
| rename ModifiedProperties{}.OldValue AS ModRem
| rename UserId AS "Actioned By"
| rename Operation AS "Action" | rename ObjectId AS "Member"
| rename TargetUserOrGroupName as modifiedUser
| table _time, ModAdd, ModRem, "Action", Member, "Actioned By" "modifiedUser"
| stats dc values("modifiedUser") by Action "Actioned By"

[marnall]

If you are getting no output, I would recommend removing the lines of the search one by one from the end until you get output, so you can narrow down your troubleshooting to the problematic line. Do you get any output if you remove the last line:

| stats dc values("modifiedUser") by Action "Actioned By"