Kusto Query to Analyze Exceptions by Type and URL
You are monitoring an e-commerce application with Application Insights. You need to analyze all exceptions that occurred in the last 24 hours, grouped by the exception type. You also need to include the URL where each exception was triggered and the number of times each type occurred. Which Log Analytics Kusto query should you use?
Quick Answer
The correct Kusto query is: `exceptions | where timestamp > ago(24h) | join kind=inner requests on operation_Id | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType, url`. This query works because it first filters the `exceptions` table for the last 24 hours, then performs an inner join with the `requests` table on `operation_Id` to correlate each exception with its triggering URL, extracts the exception type from the `innermostType` field, and finally summarizes the count by both exceptionType and url. On the AZ-204 exam, this tests your ability to correlate telemetry across tables in Application Insights, a common scenario for monitoring distributed applications. A frequent trap is forgetting the join step—without it, you lose the URL context, which is explicitly required. Memory tip: think "Exceptions need Requests for the URL"—or simply "ERU" (Exceptions, Requests, URL).
⚠ Common exam trap
The trap here is that candidates might think exception details (like type and URL) are stored directly in the `exceptions` table, but the URL is only available via a join with the `requests` table, and the exception type is in `innermostType`, not custom dimensions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
exceptions | where timestamp > ago(24h) | join kind=inner requests on operation_Id | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType, url
It uses the `exceptions` table to filter exceptions from the last 24 hours, joins with the `requests` table on `operation_Id` to correlate each exception with the request URL, and then summarizes the count by exception type (extracted from `innermostType`) and URL. This meets all requirements: grouping by exception type, including the URL, and counting occurrences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
exceptions | where timestamp > ago(24h) | join kind=inner requests on operation_Id | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType, url
Why this is correct
This query joins the exceptions table with the requests table on operation_Id to get the URL (from requests table), then groups by exceptionType (innermostType) and url, counting occurrences.
- ✗
exceptions | where timestamp > ago(24h) | extend exceptionType = tostring(customDimensions.['ExceptionType']) | summarize Count=count() by exceptionType, url = tostring(customDimensions.['Url'])
Why it's wrong here
Exception data typically does not store URL in customDimensions by default. The URL is available in the requests table, not directly in exceptions. This approach is unreliable.
- ✗
requests | where timestamp > ago(24h) and success == false | extend exceptionType = tostring(resultCode) | summarize Count=count() by exceptionType, url
Why it's wrong here
This only covers failed requests (HTTP errors), not custom exceptions caught in code. It also uses resultCode as exceptionType, which is not accurate.
- ✗
exceptions | where timestamp > ago(24h) | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType
Why it's wrong here
This returns the count per exceptionType but does not include the URL, which the requirement specifies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to analyze all exceptions that occurred in the last 24 hours from an application monitored by Application Insights. You want to group them by exception type, and for each type show the URL where it occurred and the count. Which Log Analytics Kusto query should you use?
hard- A.exceptions | where timestamp > ago(24h) | summarize count() by type, cloud_RoleInstance
- ✓ B.exceptions | where timestamp > ago(24h) | summarize count() by type, url
- C.exceptions | where timestamp > ago(24h) | summarize count() by type, operation_Name
- D.exceptions | where timestamp > ago(24h) | summarize count() by type
Why B: The query filters exceptions from the last 24 hours using `timestamp > ago(24h)`, groups them by `type` (exception type) and `url` (the URL where the exception occurred), and then counts occurrences per group with `summarize count()`. This directly matches the requirement to show, for each exception type, the URL and the count.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.