Introduction

Power BI Desktop is a free application you install on your local computer that lets you connect to, transform, and visualize your data. With Power BI Desktop, you can connect to multiple different sources of data, and combine them (often called modelling) into a data model.

PowerBI can be downloaded from Microsoft Power Platform

As LucidLink Audit Trail files have the same schema you can combine them into a single logical table.  This makes it easy to create visualizations of the data.  Follow the steps below to get started.

Importing Data

Open PowerBI
Click Blank Report

Click Get data from another source

Select Folder and press Connect

Navigate to the audit log folder on the Filespace and press OK

Select Combine and Transform Data

If prompted, change delimiter to Tab so the all data is in a single column and press OK

Transforming the data

Select Transform Tab, Column 1 and Parse > JSON

Click the icon to expand the column contents

Untick Use original column name as prefix and OK

Expand device, event and user columns, ticking "use original column name as prefix"

Do the same for Operation, and if it's missing add the optional targetPath key value pair in the formula at the top (the red boxes below)

= Table.ExpandRecordColumn(#"Expanded Column1", "operation", {"action", "entryPath", "fileId", "targetPath"}, {"operation.action", "operation.entryPath","operation.fileId","operation.targetPath"})

Click the check mark to accept it

Add Column and Custom Column to display the custom column dialog box

Enter datetime as the New column name

Add the following formula to create a usable datetime value:

#datetime(1970,1,1,0,0,0) + #duration(0,0,0,[timestamp]/1000000)

Press OK

Right click the header of the new column and select Change Type > Date/Time

Select Home tab and then Close/Apply

We now have the dataset loaded into the application and we can use it to build interactive visualization dashboards.