exam questions

Exam AZ-104 All Questions

View all questions & answers for the AZ-104 exam

Exam AZ-104 topic 2 question 22 discussion

Actual exam question from Microsoft's AZ-104
Question #: 22
Topic #: 2
[All AZ-104 Questions]

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

  • A. Get-Event Event | where {$_.EventType == "error"}
  • B. search in (Event) "error"
  • C. select * from Event where EventType == "error"
  • D. search in (Event) * | where EventType -eq "error"
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
GepeNova
Highly Voted 3 years, 9 months ago
Correct B Tested in lab Home>>Monitor>>Logs All command queries return syntax error except Search in (Event) "error"
upvoted 49 times
djhyfdgjk
1 year, 4 months ago
Just testet in actual Azure LAW. "B" returns syntax error.
upvoted 1 times
...
...
NaoVaz
Highly Voted 2 years, 10 months ago
Selected Answer: B
B) 'search in (Event) "error"' Seems to be the correct option. Tested in lab.
upvoted 8 times
...
09734b4
Most Recent 2 weeks ago
Selected Answer: D
A. Incorrect: This is PowerShell syntax, not KQL. Log Analytics requires KQL for queries inside the workspace. B. Incorrect / Incomplete: This will search for the string "error" in the Event table, but: It doesn’t filter specifically on the EventType field. Could return unrelated results where "error" appears anywhere. C. Incorrect: This is SQL-style syntax, not valid KQL. D. Correct KQL syntax: search in (Event) *: Pulls all records from the Event table. | where EventType -eq "error": Filters where EventType equals "error".
upvoted 1 times
...
khamrumunnu
1 month, 3 weeks ago
Selected Answer: B
B. search in (Event) "error" is a valid KQL statement. It tells Log Analytics to search for the word “error” in the Event table, across all fields. It’s useful when you're unsure about the exact field but want to do a full-text search. Why not the others? A. Get-Event Event | where {$_.EventType == "error"} This is PowerShell syntax, not KQL. It won't work in Log Analytics. C. select * from Event where EventType == "error" This is SQL syntax, not valid in Log Analytics. D. search in (Event) * | where EventType -eq "error" -eq is PowerShell-style comparison, not KQL. In KQL, you'd use == for comparison, not -eq.
upvoted 1 times
...
Ivanvazovv
4 months ago
Selected Answer: B
Got curious because I've never used such syntax in KQL so I tested. A is a powershell type query, while C is a SQL type. Strangely enough B worked and is the correct answer.
upvoted 1 times
...
RVivek
8 months, 1 week ago
Selected Answer: B
https://learn.microsoft.com/en-us/kusto/query/search-operator?view=microsoft-fabric#search-a-specific-table
upvoted 3 times
...
Sifon_n
8 months, 2 weeks ago
Selected Answer: B
Definitely B
upvoted 1 times
...
happpieee
8 months, 3 weeks ago
Selected Answer: B
B, with correct KQL syntax.
upvoted 1 times
...
mcc
9 months, 3 weeks ago
Correct B // 1. Simple term search over all unrestricted tables and views of the database in scope search "billg" // 2. Like (1), but looking only for records that match both terms search "billg" and ("steveb" or "satyan") // 3. Like (1), but looking only in the TraceEvent table search in (TraceEvent) and "billg" // 4. Like (2), but performing a case-sensitive match of all terms search "BillB" and ("SteveB" or "SatyaN") // 5. Like (1), but restricting the match to some columns search CEO:"billg" or CSA:"billg" // 6. Like (1), but only for some specific time limit search "billg" and Timestamp >= datetime(1981-01-01) // 7. Searches over all the higher-ups search in (C*, TF) "billg" or "davec" or "steveb" // 8. A different way to say (7). Prefer to use (7) when possible union C*, TF | search "billg" or "davec" or "steveb"
upvoted 3 times
...
MCLC2021
9 months, 3 weeks ago
The correct option in Kusto Query Language (KQL) is C: Option C: select * from Event where EventType == "error" This command selects all rows from the table named “Event” where the value of the column “EventType” is equal to “error”. The other options are not syntactically correct in KQL: Option A: Get-Event Event | where {$_.EventType == "error"} This is not a valid syntax in KQL. The “Get-Event” command does not exist in KQL. Option B: search in (Event) "error" Although it resembles KQL, it is not a valid syntax. The keyword “search” is not used this way in KQL. Option D: search in (Event) * | where EventType -eq "error" Similar to option B, the “search” keyword is not used this way in KQL. Additionally, the comparison should be with “==”, not “-eq”.
upvoted 4 times
...
Neel2211
10 months, 1 week ago
The correct correct answer would be : D. search in (Event) * | where EventType -eq "error" Log Analytics Workspace has its root usage with the querying of data/logs specifically using the KQL. Option D represents the correct syntax for querying using KQL.
upvoted 1 times
...
Wojer
1 year, 4 months ago
Event | where EventLevelName == "Error"
upvoted 2 times
...
ricardona
1 year, 8 months ago
Selected Answer: B
The correct query to run in Workspace1 to view the error events from a table named Event is: B. search in (Event) “error” This query will search for the term “error” in the Event table. The other options are not valid queries for Azure Log Analytics. Azure Log Analytics uses a version of the Kusto query language, and these queries do not conform to the correct syntax. For example, the ‘select’ statement is not used in Kusto, and PowerShell-style syntax (like option A) is not applicable here. Option D is incorrect because it attempts to use a mix of Kusto and PowerShell syntax.
upvoted 2 times
...
Mehedi007
1 year, 11 months ago
Selected Answer: B
Tested in lab.
upvoted 1 times
...
Andreas_Czech
2 years, 1 month ago
Selected Answer: B
like GepeNova Correct is B Tested in LAB
upvoted 2 times
...
Mysystemad
2 years, 1 month ago
B correct
upvoted 1 times
...
Exilic
2 years, 2 months ago
Selected Answer: D
OpenAI "The correct query to view the error events from the table named Event in the Azure Log Analytics workspace Workspace1 is: D. search in (Event) * | where EventType -eq "error" Explanation: Option A is a PowerShell command, not a Log Analytics query language (KQL) command. Option B is not a valid KQL query. The correct syntax for searching for events in a Log Analytics workspace is "search <query>". Option C is a valid KQL query, but it is not the best option since it selects all columns from the Event table. It is recommended to select only the necessary columns to improve the query performance. Option D is a valid KQL query that searches for all events in the Event table where the EventType column equals "error". This is the correct query to view the error events from the Event table."
upvoted 2 times
Nana1990
2 years ago
Apologies for the confusion. You are correct. The correct query to view the error events from the "Event" table in Azure Log Analytics Workspace1 is: B. search in (Event) "error" This query uses the 'search' operator to search for the keyword "error" within the "Event" table in Azure Log Analytics Workspace1. It will return all the events that contain the keyword "error".
upvoted 1 times
...
xRiot007
2 years, 1 month ago
Lab tests show B is the correct option. This should override whatever OpenAI answered.
upvoted 3 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...