Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.

Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.

Exam AZ-400 topic 2 question 18 discussion

Actual exam question from Microsoft's AZ-400
Question #: 18
Topic #: 2
[All AZ-400 Questions]

DRAG DROP -
You have several Azure virtual machines that run Windows Server 2019.
You need to identify the distinct event IDs of each virtual machine as shown in the following table.

How should you complete the Azure Monitor query? To answer, drag the appropriate values to the correct locations. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Show Suggested Answer Hide Answer
Suggested Answer:
You can use makelist to pivot data by the order of values in a particular column. For example, you may want to explore the most common order events take place on your machines. You can essentially pivot the data by the order of EventIDs on each machine.
Example:

Event -
| where TimeGenerated > ago(12h)
| order by TimeGenerated desc
| summarize makelist(EventID) by Computer
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/advanced-aggregations

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
an26
Highly Voted 3 years, 2 months ago
You might find it useful to create a list only of distinct values. This list is called a set, and you can generate it by using the makeset command: Event | where TimeGenerated > ago(12h) | order by TimeGenerated desc | summarize makeset(EventID) by Computer
upvoted 94 times
monniq
3 years, 1 month ago
makeset looks like best option https://docs.microsoft.com/fi-fi/azure/data-explorer/kusto/query/samples?pivots=azuremonitor
upvoted 6 times
...
Albelev
3 years, 1 month ago
Event where TimeGenerated > ago(12h) order by TimeGenerated desc summarize makelist(EventID) by Computer https://docs.microsoft.com/fi-fi/azure/data-explorer/kusto/query/samples?pivots=azuremonitor
upvoted 5 times
AlMargoi
2 years, 6 months ago
It is makeset(EventID) because the output contains unique values.
upvoted 4 times
...
...
Webpilot
11 months, 2 weeks ago
It is obviously makeset. What's different about the function is that it returns a set of unique values.
upvoted 1 times
...
...
Zonq
Highly Voted 3 years, 2 months ago
I think that correct solution is to use summarize makeset(EventId) as makeset select distinct values. In question there is written: "You need to identify the distinct event IDs of each virtual machine as shown in the following table." and I think we cannot assume that eventId won't repeat in multiple logs.
upvoted 26 times
...
chloaus
Most Recent 2 months, 1 week ago
make_set(): Creates a dynamic array of the set of distinct values that expr takes in the group. make_list(expr [, maxSize]: Creates a dynamic array of all the values of expr in the group. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/make-set-aggregation-function https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/make-list-aggregation-function
upvoted 2 times
...
ozbonny
3 months, 4 weeks ago
I'll go by summarize makelist
upvoted 1 times
...
gabo
8 months, 3 weeks ago
In Whizlabs, the same question has the answer as count() instead of make_set()
upvoted 2 times
...
yana_b
10 months, 1 week ago
Provided solution is correct
upvoted 1 times
...
Tyler2023
11 months ago
So the requirements is "You need to identify the distinct event IDs" take note the "distinct" and here is the difference between set and list List: A list is an ordered collection of elements, where duplicate values are allowed. The order of elements matters, and elements can be accessed by their index in the list. Lists allow duplicate values, so an element can appear multiple times in the same list. Set: A set is an unordered collection of distinct elements, meaning each element can occur only once. The order of elements does not matter in a set. Sets do not allow duplicate values, so each element can only appear once in the set. So that answer should be summarize makeset(EventId) by Computer
upvoted 2 times
...
wiliammbr
11 months, 2 weeks ago
summarize and make_set make_list does not do distinct
upvoted 2 times
...
Whatsamattr81
1 year, 4 months ago
says 'distinct' ... i'd use makeset
upvoted 2 times
...
networkmaniac01
1 year, 4 months ago
Both queries will return distinct event IDs for each virtual machine, but the way the event IDs are presented is different. The first query, "Event - | where TimeGenerated > ago(12h) | order by TimeGenerated desc | summarize makeset(EventID) by Computer" will return a set of distinct event IDs for each virtual machine, so it will eliminate the duplicate event IDs and will present the event IDs in an unordered format. The second query, "Event - | where TimeGenerated > ago(12h) | order by TimeGenerated desc | summarize makelist(EventID) by Computer" will return a list of all the event IDs for each virtual machine, including duplicates and will present the event IDs in an ordered format. So, it depends on the use case, if you want to identify the distinct events and eliminate the duplicates, it is better to use the first query. If you want to see all the events including the duplicates, it's better to use the second query.
upvoted 3 times
xRiot007
10 months, 2 weeks ago
Only makeset will filter duplicates and return distinct values. The problem states that you need to identify distinct value. Because there are no other operations after the boxes, the only correct option is to use makeset.
upvoted 1 times
...
...
srine69
1 year, 8 months ago
make_set() (aggregation function) Creates a dynamic JSON array of the set of distinct values that Expr takes in the group. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/makeset-aggfunction
upvoted 1 times
...
srine69
1 year, 8 months ago
makelist() has been deprecated in favor of make_list. The legacy version has a default MaxSize limit of 128.
upvoted 2 times
...
syu31svc
1 year, 10 months ago
https://docs.microsoft.com/fi-fi/azure/data-explorer/kusto/query/samples?pivots=azuremonitor answer is summarize makeset()
upvoted 3 times
...
Govcomm
1 year, 11 months ago
summary --> Makelist
upvoted 1 times
...
Leandrocei
1 year, 11 months ago
Summarize / makeset(EventId). Came today 22 july 9
upvoted 4 times
...
Eltooth
2 years ago
Summarise Makeset
upvoted 2 times
...
UnknowMan
2 years, 1 month ago
summarize + makeset (for distinct) https://docs.microsoft.com/fr-fr/azure/data-explorer/kusto/query/makeset-aggfunction
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...