An Azure App Service web application experiences intermittent failures. You are troubleshooting the issues by querying Application Insights telemetry.
You need to correlate the exceptions recorded over the last hours with their associated failed requests to identify the most common problem IDs.
Which KQL query should you execute to retrieve this data with the best query performance?
- Aexceptions
| where timestamp > ago(24h)
| join kind=inner (
requests
| where success == false
) on operation_Id
| summarize OccurrenceCount = count() by problemId
| top 5 by OccurrenceCount desc - Bexceptions
| join kind=inner (
requests
| where success == false
) on operation_Id
| summarize OccurrenceCount = count() by problemId
| top 5 by OccurrenceCount desc - exceptions
| where timestamp > ago(24h)
| join kind=inner (
requests
| where timestamp > ago(24h)
| where success == false
) on operation_Id
| summarize OccurrenceCount = count() by problemId
| top 5 by OccurrenceCount descCevap - Dexceptions
| join kind=inner (
requests
| where success == false
) on operation_Id
| where timestamp > ago(24h)
| summarize OccurrenceCount = count() by problemId
| top 5 by OccurrenceCount desc
Cevap
The correct query applies the 'where timestamp > ago(24h)' filter to both the exceptions and the requests tables before performing the inner join.
The correct query applies the time filter to both the exceptions table and the requests subquery before executing the join. In Kusto Query Language (KQL), filtering tables by time range as early as possible—especially on both sides of a join—minimizes the dataset size processed in memory, yielding the best query execution performance.
Adım Adım Çözüm
Anahtar Kavram
Best practices for KQL query optimization when joining high-volume telemetry tables in Application Insights.