AZ-104 Certification Practice Question #56

Question

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

Accepted Answer

Log Analytics workspace logs are queried using Kusto Query Language (KQL). Among the choices, B uses valid KQL search operator syntax: `search in () ""`. Option A is PowerShell. Option C is SQL. Option D is incorrect because it uses the PowerShell-style operator `-eq` rather than the KQL operator `==` (and `search in (Event) * | where EventType == "error"` would have been correct had it been written that way, but with `-eq` it is syntactically invalid). Thus, option B is the only syntactically correct and functional query option presented.

More AZ-104 practice questions