Log Analytics & KQL
The query workspace where Azure logs live, and the KQL patterns you need to write under time pressure.
Readiness
0%
2h 30m baseline
Exam memorization points
- A workspace is the unit of ingestion, retention, access control and billing for log data.
- Familiar tables: Heartbeat, Perf, Event, Syslog, AzureActivity, AzureDiagnostics, ContainerLog, AppRequests and AppTraces.
- Query shape: Table | where | summarize by bin(TimeGenerated, 5m) | project | order by | take | render timechart.
- Default interactive retention is 30 days and can be extended to a much longer period; the archive tier is queried with search jobs.
- Access is controlled by workspace RBAC plus optional table-level RBAC, which is how you restrict sensitive tables.
- Cross-workspace queries use workspace() and app() and require permissions on every workspace referenced.
Traps & distractors
- Omitting a TimeGenerated filter, which makes every query scan the retained data set and cost more.
- Using AzureDiagnostics when the resource was configured for resource-specific tables; the table name depends on the diagnostic setting mode.
- Expecting archived data to be queryable like interactive data. Archive requires a search job or restore.
- Assuming Application Insights is always workspace-based. Classic mode still exists and behaves differently.
Suggested lab
Write the five KQL queries you will need
Practise the aggregations the exam and real operations both use.
- 1Query average CPU per computer in 15-minute bins from the Perf table.
- 2Find the ten most frequent Event IDs in the last 24 hours.
- 3List all VM start and stop operations from AzureActivity with the caller identity.
- 4Union two tables to compare inbound and outbound flow totals.
- 5Save the best query as a function and alert on it.
Microsoft Learn
- Log Analytics overviewdoc
- Search Microsoft Learn: KQL tutorial summarize bin timechart Log Analytics workspace retentionsearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight56% × 25% = 13.9
This topic's domain carries 12.5% of the exam objectives.
- Dependency leverage20% × 20% = 4.1
1 later topic depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Baseline study time
2h 30m
Complexity
4 / 5
Remaining to target
2h 8m
Status weight
0%
Topics: log analytics, kql, workspace, retention, table, query, azureactivity
Weak neighbours in Monitoring