Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-01-2026 09:43 PM
Thanks @pradeep_singh for the quick help!
Sharing my understanding so others can benefit:
Why I was getting inconsistent UC table names
In the Databricks system.access.audit logs, the table metadata can appear in multiple request_params fields, depending on the API/action used:
- table_full_name – appears for most Delta/UC ops
- full_arg_name – appears for some Catalog operations
- Nested: catalog_name, schema_name, table_name – appears for granular resource access logs
- table_url / url – appears for legacy paths or volume-like structures
Because these were populated differently across actions (getTable, listSummaries, updateTable, etc.), I saw inconsistent table names.
Correct approach: Use a prioritized COALESCE
To avoid missing any UC table, the right way is to extract the table name in priority order, falling back to the next field only if the previous one is NULL.
Example:
WITH workspace_details AS (
SELECT
'UC' as usage_type,
a.workspace_id,
w.workspace_name,
COALESCE(
a.request_params['full_arg_name'], -- Priority 1
a.request_params['table_full_name'], -- Priority 2
CONCAT(
a.request_params['catalog_name'], '.',
a.request_params['schema_name'], '.',
a.request_params['table_name']
), -- Priority 3
a.request_params['table_url'], -- Priority 4
a.request_params['url'] -- Priority 5 (fallback)
) AS full_table_name,
a.event_date,
COALESCE(a.request_params['table_url'], a.request_params['url']) AS path
FROM system.access.audit a
LEFT JOIN system.access.workspaces_latest w
ON a.workspace_id = w.workspace_id
WHERE event_date >= current_date() - {days}
)
Result
This approach ensures:
- Consistent UC table identification
- No more missing or mismatched table names across operations
Thanks again @pradeep_singh — this solution works much better now.
