Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator needs to monitor a set of Azure virtual machines that report to a Log Analytics workspace. The administrator must identify virtual machines that have not sent a heartbeat in the last 1515 minutes, but were active and sent a heartbeat within the last 2424 hours.

Which of the following Kusto Query Language (KQL) queries should the administrator run? (Select two.)

  1. kql
    Heartbeat
    | where TimeGenerated > ago(24h)
    | summarize LastHeartbeat = max(TimeGenerated) by Computer
    | where LastHeartbeat < ago(15m)
    Answer
  2. kql
    Heartbeat
    | summarize LastHeartbeat = max(TimeGenerated) by Computer
    | where LastHeartbeat between (ago(24h) .. ago(15m))
    Answer
  3. C
    kql
    Heartbeat
    | where TimeGenerated between (ago(24h) .. ago(15m))
    | summarize LastHeartbeat = max(TimeGenerated) by Computer
  4. D
    kql
    Heartbeat
    | where TimeGenerated > ago(24h)
    | summarize LastHeartbeat = max(TimeGenerated) by Computer
    | where LastHeartbeat > ago(15m)

Answer

The two correct queries summarize the maximum TimeGenerated per computer first, and then filter the results to find those where the last heartbeat occurred between 2424 hours ago and 1515 minutes ago.
The correct queries aggregate the latest heartbeat per computer before applying the inactivity check. The query that filters raw data to the last 2424 hours and then keeps computers with a last heartbeat older than 1515 minutes successfully isolates offline systems. The query using the between operator on the aggregated last heartbeat achieves the exact same logical result by selecting computers whose latest heartbeat falls within the inactive window of 2424 hours to 1515 minutes ago.

Step-by-Step Solution

1
Analyze the log source and aggregation requirement
The target table is the Heartbeat table, and the query must group results by Computer while finding the maximum timestamp representing the most recent heartbeat.
Grouping by Computer is necessary because each virtual machine sends multiple heartbeats over time, and we need to evaluate only the most recent status of each machine.
2
Determine the temporal filters and order of operations
To avoid false positives, the filter for the inactivity threshold (older than 1515 minutes) must be applied after the maximum timestamp is calculated for each computer.
If records are filtered before aggregation, the query will evaluate older heartbeats of active virtual machines and incorrectly report them as offline.
3
Validate equivalent queries matching the requirements
One valid query limits the dataset to the last 2424 hours, aggregates by computer, and filters out results with a heartbeat in the last 1515 minutes. The other valid query aggregates first and then uses the KQL between operator to filter the aggregated timestamp directly.
Both approaches correctly identify computers that have their absolute latest heartbeat within the 2424-hour to 1515-minute window.

Key Concept

KQL Query Order of Operations and Temporal Aggregations
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic