Queries for the MNFSystemSessionHistoryUpdates table

Find all entries where session update user is admin

System session history update events are projected from devices. This query will list out all logs where session update user is admin.

MNFSystemSessionHistoryUpdates
| where EventCategory == "SystemSessionHistoryUpdates"
| project EventName, EventCategory, DeviceId, DeviceName, FabricId, TimeGenerated, DiffTimeStamp, GnmiTimeStamp, SessionUpdateSessionId, SessionUpdateUser, SessionDiffs
| sort by TimeGenerated desc
| limit 100