Knowledge check

Completed

1.

What is a good first step to analyzing logs in Azure Monitor Logs?

Write a KQL query to retrieve all relevant data.

Carefully look through all of the log data in your Log Analytics workspace.

Define your analysis goals and assess which tables in your Log Analytics workspace hold the data that's relevant to your analysis

2.

What can you do to familiarize yourself with the raw log data you've collected in a table?

Run simple queries, like take 10 and distinct <column name>, on a specific table or use the Log Analytics user interface to search through, filter and explore the data.

Use the make_set() aggregate function to group together all of the data in the table so you can see it all in one place.

Export the data to Excel or an external tool.

3.

How can you enrich your query results with additional data that's not available in the table you've queried in Log Analytics?

Use the KQL join operator to retrieve information from a different table.

Use the KQL import operator to import the data from a different location.

Add a column to the query results and populate the missing data manually.

You must answer all questions before checking your work.