Examkin

Question

Difficulty: EasyQuery and Analyze Application Insights Telemetry

You are troubleshooting a high-volume Azure web application that sends telemetry to Application Insights. You need to write a Kusto Query Language (KQL) query to retrieve all failed requests that occurred during the last 24 hours.

Which of the following queries is the most efficient and syntactically correct way to retrieve this data?

  1. A
    requests
    | where success == false
  2. B
    requests
    | where success == false
    | where timestamp > ago(24h)
  3. requests
    | where timestamp > ago(24h)
    | where success == false    Answer
  4. D
    requests
    | where timestamp > ago(24h) and success = false

Answer

The query that filters by timestamp first and then by success using double equals is the correct and most efficient choice.
The correct query applies the timestamp filter immediately after referencing the requests table, ensuring that only records from the last 24 hours are scanned. It then correctly uses the double equals operator to check for failed requests.

Step-by-Step Solution

1
Identify the table to query.
The 'requests' table contains request telemetry.
We need to find failed web requests.
2
Apply a time-range filter as the first operation.
Adding '| where timestamp > ago(24h)' restricts the query to the last 24 hours.
Applying the time filter first ensures the query engine only scans the relevant data partition, optimizing performance.
3
Filter for failed requests.
Adding '| where success == false' filters for failures.
The 'success' column is a boolean indicating request status, and comparison requires double equals (==).

Key Concept

Applying time-range filters early in KQL queries to optimize database scanning performance.
Rate this question

Topics

Query and Analyze Application Insights Telemetry