In Workspace1 (Log Analytics), which query should you run to view error events from the Event table?
Choose an answer
Tap an option to check your answer.
Correct answer: Event | search "error".
Why this is the answer
The correct query is Event | search "error" because it uses Kusto Query Language (KQL), which is the standard for Azure Monitor Logs. The Event table is specified, and the search operator efficiently finds rows containing the string "error" in any column. Incorrect options: Get-Event Event | where {$.EventType == "error"} uses PowerShell syntax, not KQL. select from Event where EventType == "error" uses SQL syntax, not KQL. search in (Event) | where EventType ■€"eq ■€error■€ is syntactically incorrect KQL and uses an invalid comparison operator.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed