From a1a2c472663ca42bbc3529c8b619e48d9b2aafaf Mon Sep 17 00:00:00 2001
From: Costas K <11378310+kacos2000@users.noreply.github.com>
Date: Mon, 12 Jul 2021 17:59:17 +0300
Subject: [PATCH] AppInteractivity + AppInteractivitySummary

---
 AppInteractivity.sql | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/AppInteractivity.sql b/AppInteractivity.sql
index 6fdbe61..1523ba9 100644
--- a/AppInteractivity.sql
+++ b/AppInteractivity.sql
@@ -17,10 +17,10 @@ json_extract(events_persisted.payload,'$.time') as 'UTC TimeStamp',
 -- Timestamp from json payload
 datetime((timestamp - 116444736000000000)/10000000, 'unixepoch','localtime') as 'Local TimeStamp',
 json_extract(events_persisted.payload,'$.ext.loc.tz') as 'TimeZome',
-json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq',
+json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq', -- 
 
 -- events
-json_extract(events_persisted.payload,'$.data.EventSequence') as 'EventSequence',
+json_extract(events_persisted.payload,'$.data.EventSequence') as 'EventSequence', -- AppInteractivity% specific
 json_extract(events_persisted.payload,'$.data.AggregationStartTime') as 'AggregationStartTime', -- Start date and time of AppInteractivity aggregation
 time(json_extract(events_persisted.payload,'$.data.AggregationDurationMS'),'unixepoch') as 'AggregationDuration', -- Actual duration of aggregation period (in milliseconds)
 -- App name
@@ -100,7 +100,5 @@ where
 -- include events:
   events_persisted.full_event_name in ('Win32kTraceLogging.AppInteractivity','Win32kTraceLogging.AppInteractivitySummary' )
 
-
-  
- -- Sort by date descending (newest first)
-order by events_persisted.timestamp desc
\ No newline at end of file
+ -- Sort by event sequence number descending (newest first)
+order by cast(seq as integer) desc
\ No newline at end of file