An administrator needs to write a Kusto Query Language (KQL) query in a Log Analytics workspace. The query must retrieve all records from the AzureActivity table where the Level column is equal to "Error" and the event occurred within the last 24 hours.
Which two of the following KQL queries will retrieve the required records? (Select two.)
- AzureActivity
| where Level == "Error" and TimeGenerated > ago(24h)Cevap - AzureActivity
| where TimeGenerated > ago(1d)
| where Level == "Error"Cevap - CAzureActivity
| filter Level == "Error" and TimeGenerated > ago(24h) - DAzureActivity
| where Level = "Error" and TimeGenerated > ago(24h)
Cevap
The correct queries are the ones that use the where operator with the double equals comparison, either as a single compound expression or as sequential where clauses.
The correct KQL queries use the where operator to filter the records and the double equals (==) operator to evaluate equality on the Level column. They also correctly utilize the ago function to filter the TimeGenerated column, using either 24h or 1d as the duration. Consecutive where clauses in KQL act as a logical AND.
Adım Adım Çözüm
Anahtar Kavram
Filtering and basic syntax rules in Kusto Query Language (KQL)