AZ-400 Question 304
Single answerYou manage an Azure DevOps environment where pipeline logs are stored in a table named 'PipelineLogs' within Azure Log Analytics. You need to retrieve logs from the last 24 hours that have a severity level of 'Error,' then group these errors by their error type and sort by the count of each error type in descending order. Which KQL query satisfies these requirements?
- A
PipelineLogs | where TimeGenerated < ago(24h) | where Severity == "Error" | summarize count() by ErrorType | order by count_ desc
- B
PipelineLogs | where TimeGenerated >= ago(24h) | where Severity == "Error" | summarize result = count() by ErrorType | order by result desc
- C
PipelineLogs | where TimeGenerated >= ago(24h) | project ErrorType | distinct ErrorType
- D
PipelineLogs | where Severity == "Error" | extend Last24hrs = now() | summarize count() by ErrorType | order by count_ desc
Show answer and explanation
Correct answer: B
Explanation
When troubleshooting Azure DevOps pipelines, you often need to filter logs by a specific time range and summarize error counts. Using 'where TimeGenerated >= ago(24h)' filters logs from the last 24 hours, while 'summarize count() by
- A. Incorrect.
Option A uses a filter with 'TimeGenerated < ago(24h)' which retrieves logs older than 24 hours, not within the last 24 hours. Therefore, it does not meet the requirement.
- B. Correct.
Option B is correct because 'TimeGenerated >= ago(24h)' filters the logs from the last 24 hours, 'where Severity == "Error"' picks only error logs, 'summarize result = count() by ErrorType' groups by the error type and computes the count, and 'order by result desc' sorts by the count in descending order.
- C. Incorrect.
Option C filters the correct time range but only projects and lists distinct error types without summarizing or ordering by count, so it does not meet the requirement to count and sort by the number of occurrences.
- D. Incorrect.
Option D fails to filter logs by time; 'extend Last24hrs = now()' just adds a column with the current timestamp, so it does not specifically select logs from the last 24 hours.