json_extract(events_persisted.payload,'$.data.EventSequence')as'EventSequence',-- AppInteractivity% specific
json_extract(events_persisted.payload,'$.data.AggregationStartTime')as'AggregationStartTime',-- Start date and time of AppInteractivity aggregation
json_extract(events_persisted.payload,'$.data.AggregationStartTime')as'AggregationStartTime (UTC)',-- Start date and time of AppInteractivity aggregation
time(json_extract(events_persisted.payload,'$.data.AggregationDurationMS'),'unixepoch')as'AggregationDuration',-- Actual duration of aggregation period (in milliseconds)
-- App name
casewhensubstr(json_extract(events_persisted.payload,'$.data.AppId'),1,1)is'W'-- Windows Application x32/x64
@ -92,13 +91,16 @@ trim(json_extract(events_persisted.payload,'$.ext.user.localId'),'m:') as 'UserI
sidas'User SID',
tag_descriptions.tag_name,-- where you'll see these events in MS Diagnostic Data Viewer app