|
|
|
@ -37,7 +37,7 @@ case json_extract(events_persisted.payload,'$.data.volumeMountedReadOnly')
|
|
|
|
|
when true then 'Yes'
|
|
|
|
|
when false then 'No'
|
|
|
|
|
end as 'ReadOnly',
|
|
|
|
|
payload,
|
|
|
|
|
|
|
|
|
|
json_extract(events_persisted.payload,'$.data.volumeFat32') as 'volumeFat32',
|
|
|
|
|
json_extract(events_persisted.payload,'$.data.totalClusters') as 'totalClusters',
|
|
|
|
|
json_extract(events_persisted.payload,'$.data.clusterSizeBytes') as 'clusterSize',
|
|
|
|
@ -53,4 +53,4 @@ events_persisted.full_event_name like 'Microsoft.Windows.FileSystem.%' and
|
|
|
|
|
events_persisted.full_event_name like '%VolumeInfo' )
|
|
|
|
|
|
|
|
|
|
-- Sort by event date dscending (newest first)
|
|
|
|
|
order by cast(events_persisted.timestamp as integer) desc
|
|
|
|
|
order by cast(events_persisted.timestamp as integer) desc
|
|
|
|
|