Command Events Data Columns
The following table lists the data columns for each event class in the Command Events event category.
The Command Events event category has the following event classes:
The following tables list the data columns for each of these event classes.
Command Begin Class—Data Columns
| Data Column | Description |
|---|---|
| ConnectionID | Contains the unique connection ID associated with the command event. |
| TextData | Contains the text data associated with the command event. |
| ServerName | Contains the name of the instance on which the command event occurred. |
| CurrentTime | Contains the current time of the command event. |
| DatabaseName | Contains the name of the database in which the command is running. |
| EventSubclass | Contains the class of event within the command event. Supported values are: 0: Create 1: Alter 2: Delete 3: Process 4: DesignAggregations 5: WBInsert 6: WBUpdate 7: WBDelete 8: Backup 9: Restore 10: MergePartitions 11: Subscribe 12: Batch 13: BeginTransaction 14: CommitTransaction 15: RollbackTransaction 16: GetTransactionState 17: Cancel 18: Synchronize 19: Import80MiningModels 20: Attach 21: Detach 22: SetAuthContext 23: ImageLoad 24: ImageSave 25: CloneDatabase 26: CreateTabular 27: AlterTabular 28: DeleteTabular 29: Refresh 30: Interpret 31: ExtAuth1 32: DBCC (Database Consistency Checks) 33: RenameTabular 34: SequencePointTabular 35: UpgradeTabular 36: MergePartitionsTabular 37: DisableDatabase 38: Tabular JSON Command 39: Evict 40: CommitImport 10000: Other |
| NTUserName | Contains the user name associated with the command event. Depending on the environment, the user name is in the following form: - Windows user account (DOMAIN\UserName) - User Principal Name (UPN) (username@domain.com) - Service Principal Name (SPN) (appid@tenantid) - Power BI Service Account (Power BI Service) - Power BI Service on behalf of a UPN or SPN (Power BI Service (UPN/SPN)) |
| RequestProperties | Contains the XML for Analysis (XMLA) request properties associated with the command event. |
| SPID | Contains the server process ID (SPID) that uniquely identifies the user session that is associated with the command event. The SPID directly corresponds to the session GUID used by XMLA. |
| StartTime | Contains the time at which the command event started, if available. |
| SessionType | Contains the entity that caused the operation. |
| NTDomainName | Contains the domain name associated with the user account that triggered the command event. - Windows domain name for Windows user accounts - AzureAD for Microsoft Entra accounts - NT AUTHORITY accounts without a Windows domain name, such as the Power BI service |
| ClientProcessID | Contains the unique client process ID associated with the command event. |
Command End Class—Data Columns
| Data Column | Description |
|---|---|
| ConnectionID | Contains the unique connection ID associated with the command event. |
| TextData | Contains the text data associated with the command event. |
| ServerName | Contains the name of the instance on which the command event occurred. |
| CurrentTime | Contains the current time of the command event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS. |
| DatabaseName | Contains the name of the database in which the command is running. |
| Duration | Contains the approximate amount of time between the command begin and the command end event. |
| EndTime | Contains the time at which the command event ended. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS. |
| EventSubclass | Contains the class of event within the command event. Supported values are: 0: Create 1: Alter 2: Delete 3: Process 4: DesignAggregations 5: WBInsert 6: WBUpdate 7: WBDelete 8: Backup 9: Restore 10: MergePartitions 11: Subscribe 12: Batch 13: BeginTransaction 14: CommitTransaction 15: RollbackTransaction 16: GetTransactionState 17: Cancel 18: Synchronize 19: Import80MiningModels 20: Attach 21: Detach 22: SetAuthContext 23: ImageLoad 24: ImageSave 25: CloneDatabase 26: CreateTabular 27: AlterTabular 28: DeleteTabular 29: Refresh 30: Interpret 31: ExtAuth1 32: DBCC (Database Consistency Checks) 33: RenameTabular 34: SequencePointTabular 35: UpgradeTabular 36: MergePartitionsTabular 37: DisableDatabase 38: Tabular JSON Command 39: Evict 40: CommitImport 10000: Other |
| NTCanonicalUserName | Contains the user name associated with the command event. Depending on the environment, the user name is in the following form: - Windows user account (DOMAIN\UserName) - User Principal Name (UPN) (username@domain.com) - Service Principal Name (SPN) (appid@tenantid) - Power BI Service Account (Power BI Service) |
| NTUserName | Contains the user name associated with the command event. Depending on the environment, the user name is in the following form: - Windows user account (DOMAIN\UserName) - User Principal Name (UPN) (username@domain.com) - Service Principal Name (SPN) (appid@tenantid) - Power BI Service Account (Power BI Service) - Power BI Service on behalf of a UPN or SPN (Power BI Service (UPN/SPN)) |
| SPID | Contains the server process ID (SPID) that uniquely identifies the user session associated with the command event. The SPID directly corresponds to the session GUID used by XMLA. |
| StartTime | Contains the time at which the command end event started, if available. |
| CPUTime | Contains the amount of CPU time (in milliseconds) used by the process between the time of the command begin event and the command end event. |
| Error | Contains the error number of any error associated with the command event. |
| Severity | Contains the severity level of an exception associated with the command event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error |
| Success | Contains the success or failure of the command event. Values are: 0 = Failure 1 = Success |
| SessionType | Contains the entity that caused the operation associated with the command end event. |
| NTDomainName | Contains the domain name associated with the user account that triggered the command event. - Windows domain name for Windows user accounts - AzureAD for Microsoft Entra accounts - NT AUTHORITY accounts without a Windows domain name, such as the Power BI service |
| ClientProcessID | Contains the unique client process ID associated with the command event. |
1 - An internal service-generated command to perform authentication.