Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator needs to query a Log Analytics workspace to analyze virtual machine performance. The administrator must retrieve the average CPU utilization for each virtual machine in 5-minute intervals over the past hour. The results must only display intervals where the average CPU utilization exceeds 90 percent. Which KQL query should the administrator run?

  1. A
    Perf
    | where TimeGenerated > ago(1h)
    | where CounterName == "% Processor Time"
    | where avg(CounterValue) > 90
    | summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
  2. B
    Perf
    | where TimeGenerated > ago(1h)
    | where CounterName == "% Processor Time"
    | summarize average(CounterValue) by Computer, bin(TimeGenerated, 5m)
    | where average_CounterValue > 90
  3. Perf
    | where TimeGenerated > ago(1h)
    | where CounterName == "% Processor Time"
    | summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
    | where AvgCPU > 90    Answer
  4. D
    Perf
    | where TimeGenerated > ago(1h)
    | where CounterName == "% Processor Time"
    | group Computer, bin(TimeGenerated, 5m) by avg(CounterValue)
    | where avg_CounterValue > 90

Answer

The query that uses the summarize operator to calculate AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m) and then filters the output with a subsequent where AvgCPU > 90 clause.
The correct query filters the Perf table to CPU utilization data within the last hour, aggregates the data by computer and 5-minute bins, and then filters the summarized average value. KQL requires the summarize statement to run before a where statement can reference the aggregated column.

Step-by-Step Solution

1
Filter the dataset to the target time range and metric identifier.
Perf | where TimeGenerated > ago(1h) | where CounterName == "% Processor Time"
This reduces the processing load by restricting the data to the correct performance counter from the last hour.
2
Aggregate the performance counter values into 5-minute bins grouped by computer.
summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
The avg function calculates the average value, and the bin function groups the timestamps into discrete 5-minute intervals.
3
Filter the aggregated results to isolate intervals with high CPU usage.
where AvgCPU > 90
The where clause must follow the summarize statement so it can filter on the newly calculated AvgCPU column.

Key Concept

KQL Query Structure and Aggregations
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic