Home / Microsoft / AZ-300 / Question 26

Prev Question
Next Question

Question 26

You are the IT administrator for an Azure subscription. You create a Log Analytics workspace that you want to use to monitor all the virtual machines (VMs) in the subscription that have not been responsive today.

You need to create the query.

How should you create the query? To answer, select the appropriate code segments from the drop down menus.


| where TimeGenerated > ago(7d)

| summarize PLACEHOLDER 2 by Computer

| where PLACEHOLDER 3 < ago(1d)



Explanation (click to expand)

You should use the following query:


| where TimeGenerated > ago(7d)

| summarize max(TimeGenerated) by Computer

| where max_TimeGenerated < ago(1d)

This query searches the Heartbeat table for all events, TimeGenerated, that were generated more than seven days ago. It summarizes those events by the maximum time, max(TimeGenerated). It then filters those events where the maximum time generated, max_TimeGenerated, is less than one day.

References (click to expand)

Prev Question
Next Question

Load more