An administrator needs to query the AzureActivity table in a Log Analytics workspace to identify all failed attempts to write (create or update) virtual machines under the Microsoft.Compute resource provider. The analysis must cover only the last seven days. The results must display the time the operation occurred, the email address of the caller, and the associated resource group, sorted in descending order by the event time.
Which Kusto Query Language (KQL) query should the administrator run?
- AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue == 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue == 'Failed'
| project TimeGenerated, Caller, ResourceGroup
| order by TimeGenerated descAnswer - BAzureActivity
| where TimeGenerated > ago(7d)
| project TimeGenerated, Caller, ResourceGroup
| where OperationNameValue == 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue == 'Failed'
| order by TimeGenerated desc - CAzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue = 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue = 'Failed'
| project TimeGenerated, Caller, ResourceGroup
| order by TimeGenerated desc - DSELECT TimeGenerated, Caller, ResourceGroup
FROM AzureActivity
WHERE TimeGenerated > ago(7d)
AND OperationNameValue = 'Microsoft.Compute/virtualMachines/write'
AND ActivityStatusValue = 'Failed'
ORDER BY TimeGenerated DESC
Answer
The correct query is the one that filters the AzureActivity logs by time and failure status, projects the required columns, and then sorts them by time using KQL pipeline operators in the correct order.
The correct query uses KQL operators in the proper sequence: it first filters the data using where, then prunes columns using project, and finally orders the data using order by. The filters use the KQL double equals (==) operator to check for value matching.
Step-by-Step Solution
Key Concept
KQL query syntax, pipeline ordering, and operator usage in Log Analytics