A company has a set of Azure Virtual Machines that run Windows Server 2019. All of the virtual machines are sending security-related events to a Log Analytics workspace. You have to identify the distinct event ID’s being sent from the different virtual machines.

Name

Event ID

testvm1

[704,701,1501]

testvm1

[326,300,102]

You have to design the query for implementing this requirement. 

Which of the following would go into Slot 1?

Answer options:

A.count()
B.project
C.render
D.summarize

Answer – D 
First, we need to summarize the events. This can be done with the summarize function. 
Option A is incorrect because this is used to get the count of records. 
Option B is incorrect because this is used to project columns in the results. 
Option C is incorrect because this is used to render the results of the query. 
For more information on Log Analytics queries, you can refer to the below link- 

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-queries