AZ-400 Question 305
Single answerYou manage an Azure Log Analytics workspace that captures request logs for a microservice-based application. The operations team suspects that one of the services is returning HTTP 503 errors more frequently over the past 24 hours. You need to run a KQL query that retrieves all logs with a 503 response in the last 24 hours and groups them by the operation name. Which of the following queries correctly accomplishes this task?
- A
Option A: requests | where timestamp >= now(-24h) | where resultCode == 503 | summarize count() by operation_Name
- B
Option B: requests | where Timestamp < ago(24h) | where resultCode == '503' | count by operation_Name
- C
Option C: requests | where timestamp > ago(24h) and resultCode == '503' | summarize count() by operation_Name
- D
Option D: requests | where timestamp > ago(24h) | where resultCode = '503' | summarize sum() by operation_Name
Show answer and explanation
Correct answer: C
Explanation
When querying Azure Monitor Logs or Application Insights, you typically filter time-based data using 'ago()'. For instance, 'timestamp > ago(24h)' retrieves data from the last 24 hours. To count the results and group by a particular field, you use the 'summarize count() by
- A. Incorrect.
Option A Explanation: The operator now(-24h) is not valid KQL syntax for setting a time window. Instead of 'now(-24h)', the correct function is 'ago(24h)'. This query would fail because '>= now(-24h)' is not a standard approach to filter the last 24 hours in KQL.
- B. Incorrect.
Option B Explanation: This query uses a comparison 'Timestamp < ago(24h)' instead of '> ago(24h)' which would retrieve logs older than 24 hours, not the most recent 24 hours. Additionally, 'count by operation_Name' is not a valid KQL command. The correct approach is 'summarize count() by operation_Name'.
- C. Correct.
Option C Explanation: This option uses 'timestamp > ago(24h)' to filter logs within the last 24 hours and 'resultCode == 503' to filter only 503 errors. It then uses 'summarize count() by operation_Name' to return the grouped count per operation name. This is the correct query.
- D. Incorrect.
Option D Explanation: This query attempts to compare 'resultCode = '503'', which KQL treats as an assignment and is invalid. It also uses 'summarize sum() by operation_Name' rather than using 'count()'. Summing over a single field wouldn't correctly return the number of logs or requests.