Exam AZ-104 topic 6 question 22 discussion

answer is correct https://www.shudnow.io/2020/03/06/retrieving-activity-log-data-from-azure-log-analytics-part-2/

Box 1: AzureActivity The AzureActivity table has entries from the Azure activity log, which provides insight into subscription-level or management group-level events occuring in Azure. Let's see only Critical entries during a specific week. Box 2: | project Use project to include only the columns you want. Building on the preceding example, let's limit the output to certain columns

CORRECT

Given answer is right

First part: AzureActivity - This table contains the activity logs from your Azure subscription, including information about the events, their time, and the affected resources. Second part: | where Level == 'critical' - This filters the logs to only show critical events. Third part: | project TimeGenerated, OperationNameValue, ResourceId - This projects the required columns: the event time (TimeGenerated), the event name (OperationNameValue), and the affected resources (ResourceId).

1. AzureActivity 2. project https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#send-to-log-analytics-workspace Activity log data in a Log Analytics workspace is stored in a table called AzureActivity that you can retrieve with a log query in Log Analytics. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/projectoperator Select the columns to include, rename or drop, and insert new computed columns.

AzureActivity | project