See https://blog.neilsabol.site/post/extract-parse-json-to-csv-in-microsoft-m365-purview-unified-audit-log-search-results/

parse-m365-auditlogsearch-results.ps1

function parse-m365-auditlogsearch-results {
	# Collect the input and output files
	Param (
		[Parameter(Mandatory=$true)]
		[string] $auditlogsearchresultfile = "",
		[Parameter(Mandatory=$true)]
		[string] $outputcsvfilepath = ""
	)
	
	# Import the Audit Log Search Result CSV file exported from Microsoft Purview
	$importedCSV = Import-Csv $auditlogsearchresultfile
	
	# Convert the nested JSON in the AuditData column from the CSV to JSON
	$csvToJSON = $importedCSV.AuditData | ConvertFrom-Json

	# Extract all of the possible field names from the JSON and export to the new CSV file
	$csvFields = $csvToJSON | Get-Member | ?{ $_.MemberType -eq "NoteProperty" } | select -ExpandProperty Name | Sort -Unique
	$csvFields -join "," | add-content -path $outputcsvfilepath

	# Iterate through the JSON and build the new CSV file, populating fields/values that are present
	$csvToJSON | %{
		$currentEntry = $_
		[string[]]$row = @()
		$csvFields | %{
			$row += $([string]$currentEntry.$_).replace(',','|')
		}
		$row -join "," | add-content -path $outputcsvfilepath
	}
}