Which query should you run in Workspace1?

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.

You need to view the error events from a table named Event.

Which query should you run in Workspace1?
A . Get-Event Event | where ($_.EventType Ceq "error")
B . Get-Event Event | where ($_.EventType == "error")
C . search in (Event) * | where EventType Ceq "error"
D . search in (Event) "error"
E . select *from Event where EventType == "error"
F . Event | where EventType is "error"

View Answer

Answer: D

Explanation:

To search a term in a specific table, add in (table-name) just after the search operator

References:

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal