Exam AZ-400 topic 2 question 39 discussion

1. TimeGenerated > ago (7d) 2. bin(TimeGenerated, 1h) https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/agofunction Subtracts the given timespan from the current UTC time. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/binfunction Rounds values down to an integer multiple of a given bin size.

Let's say we have Perf Logs from Jan 1-31 and Today's date: Jan 31 Target perf logs are within 7 days ago, which is Jan 25 so the logic will be, Perf logs where TimeGenerated > Jan 25

let startTime = ago(7d); Perf | where TimeGenerated >= startTime | where Computer == "web1" and ObjectName == "Memory" and CounterName == "Available Bytes" | summarize avgFreeMemory = avg(CounterValue) by bin(TimeGenerated, 1h) | project TimeGenerated, avgFreeMemoryMB = avgFreeMemory / 1024 / 1024 // Convert bytes to megabytes | render timechart with ( title = 'Average Free Memory on web1 Over Last 7 Days', ytitle = 'Free Memory (MB)', xaxis = 'Time', series = ['avgFreeMemoryMB'] )

TimeGenerated > ago(7d) Bin(TimeGenerated, 1h) Syntax ago(timespan) timespan: The interval to subtract from the current UTC clock time now(). Example All rows with a timestamp in the past hour: T | where Timestamp > ago(1h) https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/ago-function

correct

Provided answer is correct

The first answer should be : 1. TimeGenerated < ago (7d) It s said "Past 7 days" so less than 7 days

Perf | where TimeGenerated > ago(7d) | where Computer == "web1" | where CounterName == "Available MBytes" | summarize avg(CounterValue) by bin(TimeGenerated, 1h) | render timechart