AZ-400 · Question #414
Drag and Drop Question You have an app named App1. You have a Log Analytics workspace named Workspace1 that contains two tables named Events and Logs. App1 manages events in multiple locations and wri
The correct answer is Logs; where timestamp > ago(2d); join ( Events; where continent == 'Asia'; ) on RequestId. The correct query order follows standard KQL (Kusto Query Language) syntax: start with the source table 'Logs', immediately filter by time range using 'where timestamp > ago(2d)' to reduce the dataset early for performance, then join with the 'Events' table to enrich the data, fi
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- Logs
- where timestamp > ago(2d)
- join ( Events
- where continent == 'Asia'
- ) on RequestId
Explanation
The correct query order follows standard KQL (Kusto Query Language) syntax: start with the source table 'Logs', immediately filter by time range using 'where timestamp > ago(2d)' to reduce the dataset early for performance, then join with the 'Events' table to enrich the data, filter joined results with 'where continent == Asia', and close the join with ') on RequestId' to specify the join key. Filtering by time before the join is a best practice in KQL as it minimizes the data processed in the expensive join operation. The join clause must be opened before the continent filter and closed with the 'on' condition to form syntactically valid KQL.
Topics
Community Discussion
No community discussion yet for this question.