SELECT distinct server_principal_name,object_name,event_time
FROM sys.fn_get_audit_file('\\10.0.0.100\Ad\Audit_DDL_678FA9A7-018F-4280-97C7-FD1861CAB760.sqlaudit ', NULL, NULL)
WHERE database_name = 'HR'and action_id='CR' and  class_type='U'  
union all
SELECT distinct server_principal_name,object_name,event_time
FROM sys.fn_get_audit_file('\\10.0.0.100\Ad\Audit_DDL_678FA9A7-018F-4280-97C7-FD1861CAB760.sqlaudit ', NULL, NULL)
WHERE database_name = 'HR'and action_id='CR' and  class_type='U' 
union all
SELECT distinct server_principal_name,object_name,event_time
FROM sys.fn_get_audit_file('\\10.0.0.100\Ad\Audit_DDL_678FA9A7-018F-4280-97C7-FD1861CAB760.sqlaudit ', NULL, NULL)
WHERE database_name = 'HR'and action_id='CR' and  class_type='U'

把查询出来的server_principal_name,object_name,event_time三个字段的结果拼接起来。