Skip to content
datastudyguides

AI-200 · 4.2.2 · Secure, monitor, and troubleshoot Azure solutions

KQL for logs

Write KQL queries to analyze logs and metrics

Filter Azure Monitor data early, aggregate with summarize, rank the result, and project only the columns you need.

Build a query as a pipeline

KQL analysis pipeline from choosing an Azure Monitor table through filtering, summarizing, ranking, and projecting only the needed columns.

Start with the narrowest table, filter early, aggregate with summarize, then rank, sort, or project the result. take returns arbitrary rows, so use top or sort when order matters.

AppDependencies
| where TimeGenerated > ago(1h)
| summarize p95 = percentile(DurationMs, 95) by Target
| top 5 by p95 desc

Count sampled requests correctly

rows can represent several original events. For sampled request data, reconstruct counts with sum(ItemCount) rather than count().

Aggregate pre-computed metrics

AppMetrics rows already contain Sum and ItemCount. To calculate a true mean across rows, divide sum(Sum) by sum(ItemCount).

Follow one operation across tables

union AppRequests, AppDependencies, AppTraces, AppExceptions
| where OperationId == "..."
| sort by TimeGenerated asc

The shared operation ID lets you reconstruct a failed transaction across requests, dependencies, logs, and exceptions.

Key points

  • Filter early: start with a table and narrow `TimeGenerated` first
  • Summarize: aggregate by groups and use `bin()` for time buckets
  • Percentiles: compute per group, then rank with `top`
  • Sampling: use `sum(ItemCount)` to reconstruct event counts
  • Metrics: mean is `sum(Sum) / sum(ItemCount)` for AppMetrics
  • Correlation: `union` telemetry tables and filter by OperationId

Click an underlined term for a one-line explanation, or see them all in the glossary .

Exam trap

take returns arbitrary rows, not the latest; use top 10 by TimeGenerated or sort by TimeGenerated desc for recent records.

Sources · 4 Microsoft Learn pages Show ▾

Checked on October 4, 2026. Report a problem

Go deeper on Microsoft Learn

Checked against Microsoft Learn on October 4, 2026. Report a problem with this card

How well do you know this?