Microsoft Azure Administrator — Question 143

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

Answer options

• A. Get-Event Event | where {$_.EventType == "error"}
• B. search in (Event) "error"
• C. select * from Event where EventType == "error"
• D. search in (Event) * | where EventType -eq "error"

Correct answer: B

Explanation

The correct answer, B, uses the proper syntax for searching within a table in Azure Log Analytics. Options A and C use incorrect query languages for this context, and option D, while it may work, is unnecessarily complex for the requirement of simply finding error events.