Examkin

Soru

Zorluk: KolayLog Analytics Workspaces and KQL Queries

You need to write a Kusto Query Language (KQL) query in Azure Log Analytics to find all heartbeat records from the last 24 hours for a virtual machine named VM1. Which KQL query should you use?

  1. A
    Heartbeat | where TimeGenerated > ago(24h) and Computer = "VM1"
  2. B
    SELECT * FROM Heartbeat WHERE TimeGenerated > ago(24h) AND Computer = 'VM1'
  3. Heartbeat | where TimeGenerated > ago(24h) and Computer == "VM1"Cevap
  4. D
    Heartbeat | filter TimeGenerated > ago(24h) and Computer == "VM1"

Cevap

The KQL query that retrieves heartbeat records using the 'where' operator and the double equals (==) comparison operator: Heartbeat | where TimeGenerated > ago(24h) and Computer == "VM1"
The query correctly initiates the scan of the Heartbeat table, pipes it to the where operator to filter based on TimeGenerated using the ago() function, and applies the string comparison constraint on the Computer column using the double equals (==) operator.

Adım Adım Çözüm

1
Select the correct target log table.
Identify the 'Heartbeat' table as the source of agent diagnostic logs.
Azure Monitor VM agent status and availability details are stored in the Heartbeat table.
2
Apply the time filter using a relative time range helper function.
Add '| where TimeGenerated > ago(24h)' to query only logs generated within the last 24 hours.
The 'ago' function dynamically calculates the start time point relative to the current execution execution.
3
Filter by the virtual machine name using the proper comparison operator.
Add 'and Computer == "VM1"' to refine the records.
In KQL, the logical equality operator is represented by '==' and is case-insensitive for strings.

Anahtar Kavram

Basic KQL querying using the where operator, time ranges, and equality comparisons.
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru