A data engineer created the cloudtrail_logs table in Amazon Athena to query CloudTrail events for audits. The engineer needs a query that returns errors with error codes since 2024-01-01 and shows the top 10 by occurrence. Which of the following queries meets that requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: select count(*) as TotalEvents, eventname, errorcode, errormessage from cloudtrail_logs where errorcode is not null and eventtime >= '2024-01-01T00:00:00Z' group by eventname, errorcode, errormessage order by TotalEvents desc limit 10;.
Why this is the answer
The correct query identifies errors by filtering for errorcode is not null and specifies the start date with eventtime = '2024-01-01T00:00:00Z'. It then groups the results by eventname, errorcode, and errormessage to count occurrences of each unique error. Finally, it orders these counts in descending order (order by TotalEvents desc) and retrieves only the top 10 (limit 10), fulfilling all requirements. The first incorrect option misses errorcode is not null, so it would include non-error events. The second incorrect option sorts by eventname asc instead of TotalEvents desc, failing to show the top 10 by occurrence. The third incorrect option omits the order by clause, which means the limit 10 would return an arbitrary 10 rows, not the top 10 by occurrence.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed