diff --git a/VirtualDesktop.sql b/VirtualDesktop.sql index 8a9b334..b0a6e99 100644 --- a/VirtualDesktop.sql +++ b/VirtualDesktop.sql @@ -11,6 +11,7 @@ json_extract(events_persisted.payload,'$.time') as 'UTC TimeStamp', datetime((timestamp - 116444736000000000)/10000000, 'unixepoch','localtime') as 'Local TimeStamp', json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq', +json_extract(events_persisted.payload,'$.data.wilActivity.threadId') as 'threadId', replace(replace(replace(events_persisted.full_event_name,'Microsoft-Windows-Desktop-Shell-Windowing.',''),'VirtualDesktop',''),'Microsoft.Windows.Shell.Switcher.','') as 'Event', json_extract(events_persisted.payload,'$.ext.metadata.f.desktopId') as 'desktopId', coalesce(json_extract(events_persisted.payload,'$.data.newDesktopId'),json_extract(events_persisted.payload,'$.data.desktopId')) as 'Current DesktopId',