Command Events Data Columns

The following table lists the data columns for each event class in the Command Events event category.

The Command Events event category has the following event classes:

The following tables list the data columns for each of these event classes.

Command Begin Class—Data Columns

Data Column Description
ConnectionID Contains the unique connection ID associated with the command event.
TextData Contains the text data associated with the command event.
ServerName Contains the name of the instance on which the command event occurred.
CurrentTime Contains the current time of the command event.
DatabaseName Contains the name of the database in which the command is running.
EventSubclass Contains the class of event within the command event. Supported values are:
0: Create
1: Alter
2: Delete
3: Process
4: DesignAggregations
5: WBInsert
6: WBUpdate
7: WBDelete
8: Backup
9: Restore
10: MergePartitions
11: Subscribe
12: Batch
13: BeginTransaction
14: CommitTransaction
15: RollbackTransaction
16: GetTransactionState
17: Cancel
18: Synchronize
19: Import80MiningModels
20: Attach
21: Detach
22: SetAuthContext
23: ImageLoad
24: ImageSave
25: CloneDatabase
26: CreateTabular
27: AlterTabular
28: DeleteTabular
29: Refresh
30: Interpret
31: ExtAuth1
32: DBCC (Database Consistency Checks)
33: RenameTabular
34: SequencePointTabular
35: UpgradeTabular
36: MergePartitionsTabular
37: DisableDatabase
38: Tabular JSON Command
39: Evict
40: CommitImport
10000: Other
NTUserName Contains the user name associated with the command event. Depending on the environment, the user name is in the following form:
- Windows user account (DOMAIN\UserName)
- User Principal Name (UPN) (username@domain.com)
- Service Principal Name (SPN) (appid@tenantid)
- Power BI Service Account (Power BI Service)
- Power BI Service on behalf of a UPN or SPN (Power BI Service (UPN/SPN))
RequestProperties Contains the XML for Analysis (XMLA) request properties associated with the command event.
SPID Contains the server process ID (SPID) that uniquely identifies the user session that is associated with the command event. The SPID directly corresponds to the session GUID used by XMLA.
StartTime Contains the time at which the command event started, if available.
SessionType Contains the entity that caused the operation.
NTDomainName Contains the domain name associated with the user account that triggered the command event.
- Windows domain name for Windows user accounts
- AzureAD for Azure Active Directory accounts
- NT AUTHORITY accounts without a Windows domain name, such as the Power BI service
ClientProcessID Contains the unique client process ID associated with the command event.

Command End Class—Data Columns

Data Column Description
ConnectionID Contains the unique connection ID associated with the command event.
TextData Contains the text data associated with the command event.
ServerName Contains the name of the instance on which the command event occurred.
CurrentTime Contains the current time of the command event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
DatabaseName Contains the name of the database in which the command is running.
Duration Contains the approximate amount of time between the command begin and the command end event.
EndTime Contains the time at which the command event ended. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
EventSubclass Contains the class of event within the command event. Supported values are:
0: Create
1: Alter
2: Delete
3: Process
4: DesignAggregations
5: WBInsert
6: WBUpdate
7: WBDelete
8: Backup
9: Restore
10: MergePartitions
11: Subscribe
12: Batch
13: BeginTransaction
14: CommitTransaction
15: RollbackTransaction
16: GetTransactionState
17: Cancel
18: Synchronize
19: Import80MiningModels
20: Attach
21: Detach
22: SetAuthContext
23: ImageLoad
24: ImageSave
25: CloneDatabase
26: CreateTabular
27: AlterTabular
28: DeleteTabular
29: Refresh
30: Interpret
31: ExtAuth1
32: DBCC (Database Consistency Checks)
33: RenameTabular
34: SequencePointTabular
35: UpgradeTabular
36: MergePartitionsTabular
37: DisableDatabase
38: Tabular JSON Command
39: Evict
40: CommitImport
10000: Other
NTCanonicalUserName Contains the user name associated with the command event. Depending on the environment, the user name is in the following form:
- Windows user account (DOMAIN\UserName)
- User Principal Name (UPN) (username@domain.com)
- Service Principal Name (SPN) (appid@tenantid)
- Power BI Service Account (Power BI Service)
NTUserName Contains the user name associated with the command event. Depending on the environment, the user name is in the following form:
- Windows user account (DOMAIN\UserName)
- User Principal Name (UPN) (username@domain.com)
- Service Principal Name (SPN) (appid@tenantid)
- Power BI Service Account (Power BI Service)
- Power BI Service on behalf of a UPN or SPN (Power BI Service (UPN/SPN))
SPID Contains the server process ID (SPID) that uniquely identifies the user session associated with the command event. The SPID directly corresponds to the session GUID used by XMLA.
StartTime Contains the time at which the command end event started, if available.
CPUTime Contains the amount of CPU time (in milliseconds) used by the process between the time of the command begin event and the command end event.
Error Contains the error number of any error associated with the command event.
Severity Contains the severity level of an exception associated with the command event. Values are:

0 = Success

1 = Informational

2 = Warning

3 = Error
Success Contains the success or failure of the command event. Values are:

0 = Failure

1 = Success
SessionType Contains the entity that caused the operation associated with the command end event.
NTDomainName Contains the domain name associated with the user account that triggered the command event.
- Windows domain name for Windows user accounts
- AzureAD for Azure Active Directory accounts
- NT AUTHORITY accounts without a Windows domain name, such as the Power BI service
ClientProcessID Contains the unique client process ID associated with the command event.

1 - An internal service-generated command to perform authentication.