Examkin

Question

Difficulty: EasyLog Analytics Workspaces and KQL Queries

An administrator wants to review write operations on virtual machines within an Azure subscription. They open the Log Analytics query editor to search the `AzureActivity` table. The query must filter for logs where `OperationNameValue` is equal to `'Microsoft.Compute/virtualMachines/write'` and restrict the output to exactly 55 records.

Which of the following queries use valid Kusto Query Language (KQL) syntax to achieve this goal? (Choose two.)

  1. AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | limit 5Answer
  2. AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | take 5Answer
  3. C
    AzureActivity | where OperationNameValue = "Microsoft.Compute/virtualMachines/write" | limit 5
  4. D
    SELECT * FROM AzureActivity WHERE OperationNameValue = 'Microsoft.Compute/virtualMachines/write' LIMIT 5

Answer

The correct queries start with the 'AzureActivity' table, filter the logs using the 'where' operator with double equals '==', and limit the records using either 'limit 5' or 'take 5'.
The correct queries begin with the data source 'AzureActivity', apply a pipeline using the pipe character '|', use the 'where' operator with the equality operator '==', and use either 'limit 5' or 'take 5'. In KQL, 'limit' and 'take' are synonyms and perform the same action of limiting the result set.

Step-by-Step Solution

1
Identify the target table and initial retrieval syntax.
The query starts with the table name 'AzureActivity'.
KQL queries begin with the data source (table name) to start the pipeline.
2
Apply the comparison filter using the correct operator.
Use '| where OperationNameValue == "Microsoft.Compute/virtualMachines/write"'.
The 'where' operator is used for filtering, and KQL requires a double equals sign '==' for evaluation of equality.
3
Select the correct operator to restrict the number of returned records.
Use '| limit 5' or '| take 5'.
In KQL, 'limit' and 'take' are equivalent operators that restrict the query results to the specified number of rows.

Key Concept

Basic KQL query structure, comparison operators, and row-limiting operators.
Estimated Time:45s
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic