Exam AZ-103 topic 16 question 1 discussion

Actual exam question from Microsoft's AZ-103

Question #: 1
Topic #: 16

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

A. Get-Event Event | where ($_.EventType ""eq "error")
B. Get-Event Event | where ($_.EventType == "error")
C. search in (Event) * | where EventType ""eq "error"
D. search in (Event) "error"
E. select *from Event where EventType == "error"

Show Suggested Answer

Suggested Answer: D 🗳️
To search a term in a specific table, add in (table-name) just after the search operator
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal

by peterhaan898 at Dec. 28, 2019, 12:38 p.m.

Comments

Submit Cancel

peterhaan898

Highly Voted 5 years, 4 months ago

D is correct. Kusto Query Language in Azure Log Analytics - Examples: search in (Table-Name) "error" <--Search string "error" in Table across all columns. search in (Table-Name) Column1:"error" <--Search string "error" in given table and column search in (Table1, Table2) Column1=="error" <-Search in given tables and columns for exact string "error".

upvoted 6 times

...

Cloudyuga

Highly Voted 4 years, 11 months ago

its a correct answers

upvoted 6 times

...

simanastasiya

Most Recent 4 years, 5 months ago

in exam az-104 29nov 2020

upvoted 3 times

...

X_L

4 years, 8 months ago

The answer is correct, even if not the best option. An alternative would be: (Event) | where EventLevelName == "Error"

upvoted 3 times

...

sjoerdstefma

5 years, 3 months ago

Table scoping To search a term in a specific table, add in (table-name) just after the search operator: Kusto Copy search in (Event) "error" | take 100

upvoted 4 times

...

Exam AZ-103 All Questions

View all questions & answers for the AZ-103 exam