Reputation: 156
I execute query:
SELECT session_server_principal_name, event_time FROM sys.fn_get_audit_file
('d:/*.sqlaudit',default,default) order by event_time
and i get so many results for each session_server_principal_name, but i'll have only last event (i'll have information about last action for each user). How can i do it?
Upvotes: 0
Views: 92
Reputation: 690
SELECT session_server_principal_name, max(event_time) FROM sys.fn_get_audit_file ('d:/*.sqlaudit',default,default) group by session_server_principal_name;
Upvotes: 1
Reputation: 1128
SELECT TOP 1 session_server_principal_name, event_time FROM sys.fn_get_audit_file
('d:/*.sqlaudit',default,default) order by event_time DESC
I added "TOP 1" at the beginning and "DESC" (for reverse "descending" order).
Upvotes: 0