Manage Azure Log Analytics Error Queries | AZ-104 Exam Prep

Viewing Errors in Azure Log Analytics Workspace

Prev Question Next Question

Question

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.

You need to view the error from a table named Event.

Which query should you run in Workspace1?

Answers

A. Get-Event Event | where {$_.EventType == "error"}

B. search in (Event) "error"

C. select * from Event where EventType == "error"

D. Get-Event Event | where {$_.EventTye ג€"eq "error"}

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer

The correct answer is C. select * from Event where EventType == "error"

Explanation:

To view the errors from a table named Event in Workspace1, we need to run a query in the Azure Log Analytics workspace. The query should select all the columns from the table where the EventType is "error".

Option A and D are PowerShell commands and cannot be run directly in the Log Analytics workspace query editor. Therefore, they are incorrect answers.

Option B is not a valid query syntax in Azure Log Analytics. The correct syntax for searching in Log Analytics is "search <query>". Therefore, option B is also incorrect.

Option C is the correct query. This query uses the "select" statement to select all columns from the table named "Event" where the EventType is "error". The double equals sign (==) is used to compare the EventType to the string "error".

Therefore, the correct query to view the error from a table named Event in Workspace1 is select * from Event where EventType == "error".

Prev Question Next Question