Dataverse - SharePoint document management site added or updated

Original query, unchanged.

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message in ("Create", "Update") and EntityName == "sharepointsite"
| mv-expand Fields
| where Fields.Name == "absoluteurl"
| extend
    SharePointAppId = int(20892),
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1]),
    SharePointUrl = tostring(Fields.Value)
| project
    TimeGenerated,
    UserId,
    ClientIp,
    Message,
    SharePointUrl,
    InstanceUrl,
    CloudAppId,
    SharePointAppId,
    AccountName,
    UPNSuffix