Examkin

Question

Difficulty: HardQuery and Analyze Application Insights Telemetry

An Azure App Service web application logs performance and error telemetry to an Azure Application Insights resource. You need to write a Kusto Query Language (KQL) query to retrieve the top 10 slowest external dependency calls based on their average duration over the past 24 hours. The results must only include dependencies associated with failed web requests. To prevent query performance degradation and avoid scanning excessive telemetry data outside the target window, the query must be optimized. Which KQL query should you execute?

  1. let failed_requests = requests
    | where timestamp > ago(24h) and success == false
    | project operation_Id;
    dependencies
    | where timestamp > ago(24h)
    | join kind=inner failed_requests on operation_Id
    | summarize AvgDuration = avg(duration) by name
    | top 10 by AvgDuration desc    Answer
  2. B
    let failed_requests = requests
    | where success == false
    | project operation_Id;
    dependencies
    | where timestamp > ago(24h)
    | join kind=inner failed_requests on operation_Id
    | summarize AvgDuration = avg(duration) by name
    | top 10 by AvgDuration desc
  3. C
    let failed_requests = requests
    | where timestamp > ago(24h) and success == false
    | project operation_Id;
    dependencies
    | join kind=inner failed_requests on operation_Id
    | summarize AvgDuration = avg(duration) by name
    | top 10 by AvgDuration desc
  4. D
    requests
    | join kind=inner dependencies on operation_Id
    | where timestamp > ago(24h) and success == false
    | summarize AvgDuration = avg(duration) by name
    | top 10 by AvgDuration desc

Answer

The query that filters both the requests and dependencies tables by timestamp greater than 24 hours ago before joining them on the operation_Id field, and then summarizes the average duration grouped by name to return the top 10 results.
The correct query applies the timestamp filter to both the requests table and the dependencies table before performing the join. In KQL, filtering all joined tables by time restricts the scanned dataset size on both inputs, ensuring maximum query efficiency and preventing timeouts.

Step-by-Step Solution

1
Filter the requests table to include only failed requests (success == false) within the last 24 hours, projecting only the operation_Id column to reduce memory usage during the join.
A lightweight temporary table/set named failed_requests containing only relevant operation IDs.
Reduces the volume of request data that needs to be joined.
2
Filter the dependencies table to include only dependencies logged in the last 24 hours.
A subset of the dependencies table containing only telemetry from the last 24 hours.
Prevents scanning the entire retention history of the dependencies table prior to the join.
3
Perform an inner join between the filtered dependencies and failed_requests on the operation_Id column.
A combined dataset of dependencies that correspond directly to failed requests in the last 24 hours.
Correlates dependency calls with the failed web requests they were part of.
4
Calculate the average duration for each dependency name using summarize and select the top 10 slowest dependencies.
The top 10 slowest external dependency calls by average duration.
Identifies the highest latency dependencies associated with request failures.

Key Concept

Optimizing KQL queries in Azure Application Insights by applying time-range filters to both sides of a join operation to minimize resource consumption.
Rate this question

Topics

Query and Analyze Application Insights Telemetry