Question 420
A data team uses KQL to transform logs before analytical storage. The current environment exhibits the following problem: a nested array is flattened and duplicates parent counts. Which corrective action addresses the root cause?
Explanation
Correct Answer
Use mv-expand with explicit intended grain and recompute measures accordingly. Choose to use mv-expand with explicit intended grain and recompute measures accordingly; expansion changes row multiplicity.
Incorrect Answers
Analysts need counts grouped by one-hour time buckets. KQL binning creates consistent event-time grouping keys.
Raw event fields contain JSON text requiring typed access. KQL queries need correctly typed values for filtering and aggregation.
A data engineer wants repeated normalized columns for all incoming events. Ingestion-time transformations can populate derived native tables.