Examkin

Question

Difficulty: EasyQuery and Analyze Application Insights Telemetry

You are investigating a brief spike in application errors that occurred within the last hour. You need to write a Kusto Query Language (KQL) query in Azure Application Insights to retrieve all recorded exceptions from the `exceptions` table. The query must be optimized to run quickly and avoid scanning historical data beyond the necessary timeframe.

Which KQL query should you use?

  1. A
    exceptions
  2. B
    exceptions
    | where timestamp == ago(1h)
  3. exceptions
    | where timestamp > ago(1h)    Answer
  4. D
    exceptions
    | where severityLevel > 3

Answer

The query that filters the exceptions table where the timestamp is greater than ago(1h).
The query that filters the exceptions table where the timestamp is greater than ago(1h) is correct because it uses the timestamp field to limit the data scan to the specified one-hour window. This is highly performant and conforms to Azure Monitor best practices.

Step-by-Step Solution

1
Identify the target telemetry table containing error details.
The target table is the exceptions table.
Application Insights stores error details and stack traces in the exceptions table.
2
Determine the time constraint required for the query.
The query must target data from the last hour (within 1 hour ago to the present).
Applying a time filter prevents scanning unnecessary historical records, which keeps the query fast and cost-effective.
3
Apply the timestamp filter using the ago function.
Filter using where timestamp > ago(1h).
Using the greater-than operator with ago(1h) selects all records created from one hour ago up to the current time.

Key Concept

Optimizing KQL queries in Azure Monitor/Application Insights by filtering on the timestamp column first to restrict the data scan volume.
Rate this question

Topics

Query and Analyze Application Insights Telemetry