AZ-104 topic 2 question 42

B) 'Event | search "error"'

Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial

Repeated question Topic2.Question22

Correct answer B

I passed with these questions and many friends passed too, all questions appeared in the real exam a great study resource, contact me on [email protected]

That's not valid KQL, try it with this sample code
let MyInMemoryTable = datatable(EventType: string, EventMessage: string, EventTime: datetime)
[
    "error", "Something bad occurred in the application.", datetime(2024-01-09T13:00:00),
    "warning", "A warning was logged by the application, be careful of error", datetime(2024-01-09T14:00:00),
    "info", "Informational message from the application.", datetime(2024-01-09T15:00:00),
    "error", "Oh noes occurred in the application.", datetime(2024-01-09T16:00:00)
];
SELECT * FROM (MyInMemoryTable) where EventType == "error"

C. select * from Event where EventType == "error"

To view the error events from a table named Event in the Azure Log Analytics workspace named Workspace1, you should run the query:
select * from Event where EventType == "error"

This query selects all the columns (*) from the Event table where the EventType is equal to "error". It will retrieve all the error events from the Event table in Workspace1.

The other options provided are not valid for querying data in Azure Log Analytics. They do not use the correct syntax or functions for querying data in Log Analytics.

B - Tested in lab (Event | search "error")

Event | search "error"