Examkin

Soru

Zorluk: OrtaLog Analytics Workspaces and KQL Queries

An administrator needs to analyze diagnostic logs for several Azure Key Vaults. The logs are collected in a Log Analytics workspace named LogsWS.

The administrator wants to retrieve the total number of operations for each Key Vault resource over the past 24 hours, grouped by the operation name.

Which Kusto Query Language (KQL) query should the administrator execute to achieve this objective?

  1. AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName    Cevap
  2. B
    AzureDiagnostics
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName
    | where TimeGenerated > ago(24h)
  3. C
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider = "MICROSOFT.KEYVAULT"
    | group by Resource, OperationName
  4. D
    AzureDiagnostics
    | select TimeGenerated, Resource, OperationName, ResourceProvider
    | where TimeGenerated > ago(24h) and ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName

Cevap

The KQL query that filters by TimeGenerated and ResourceProvider before aggregating counts using the summarize operator.
The correct query evaluates the filters before summarizing the results. This represents syntactically correct KQL and respects the pipeline mechanism where columns are stripped after summarization.

Adım Adım Çözüm

1
Filter the dataset by time range to reduce the amount of data processed early in the query pipeline.
Filters records to only those within the last 24 hours.
In KQL, filtering by TimeGenerated as early as possible optimizes performance.
2
Filter records by ResourceProvider to isolate Key Vault diagnostic events.
Only rows associated with the MICROSOFT.KEYVAULT provider are kept.
This ensures the query only groups operations relevant to the targeted service type.
3
Summarize the events by grouping them by Resource and OperationName, calculating the count of events for each group.
The final output projects the Resource, OperationName, and the counted events.
The summarize operator reshapes the output schema, removing all unreferenced columns such as TimeGenerated from the pipeline.

Anahtar Kavram

Kusto Query Language pipeline execution flow and schema transformation behavior.
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru