Microsoft Azure Administrator — Question 54

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

Answer options

• A. Get-Event Event | where {$_.EventType == "error"}
• B. Event | search "error"
• C. select * from Event where EventType == "error"
• D. search in (Event) * | where EventType ג€"eq ג€errorג€

Correct answer: B

Explanation

Option B is correct because it uses the proper syntax for querying in Azure Log Analytics to search directly for the term 'error' within the Event table. The other options either use incorrect syntax or are not the appropriate methods for querying events in Log Analytics.