Examkin

Soru

Zorluk: KolayLog Analytics Workspaces and KQL Queries

An administrator needs to write a Kusto Query Language (KQL) query in a Log Analytics workspace. The query must retrieve all heartbeat records for a virtual machine named VM1 that were generated in the last 24 hours.

Which two KQL queries meet these requirements? Select two.

  1. `Heartbeat | where Computer == "VM1" and TimeGenerated > ago(24h)`Cevap
  2. `Heartbeat | where TimeGenerated >= ago(24h) | where Computer == "VM1"`Cevap
  3. C
    `SELECT * FROM Heartbeat WHERE Computer = 'VM1' AND TimeGenerated > ago(24h)`
  4. D
    `Heartbeat | where Computer = "VM1" | where TimeGenerated > 24h`

Cevap

The correct queries are the ones starting with 'Heartbeat | where Computer == "VM1" and TimeGenerated > ago(24h)' and 'Heartbeat | where TimeGenerated >= ago(24h) | where Computer == "VM1"'.
The queries that retrieve the correct records are the query utilizing the 'and' operator within a single filter and the query chaining two separate 'where' clauses. Both configurations correctly filter the Heartbeat logs by the specified computer name and within the past 24 hours using the 'ago()' function.

Adım Adım Çözüm

1
Identify the target table and filter criteria.
The target table is `Heartbeat`. The query must filter where `Computer` equals 'VM1' and `TimeGenerated` is in the last 24 hours.
This establishes the database schema components and properties that need to be evaluated.
2
Verify correct KQL syntax for operators and functions.
String comparison requires `==`. Relative time filters require the `ago()` function to generate a datetime value.
Using `=` is invalid for comparison in a KQL `where` clause, and comparing a datetime to a timespan literal without `ago()` is invalid.
3
Evaluate how multiple query filters can be combined.
Filters can be combined within a single `where` clause using the logical `and` operator, or chained sequentially using multiple pipe (`|`) symbols.
Both methods are syntactically valid in KQL and produce the same output.

Anahtar Kavram

Writing basic queries in Log Analytics using KQL table operators, where clauses, comparison operators, and time functions.
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru