You have a custom Microsoft Sentinel workbook named Workbook1.
You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows.
What should you do?
You have a custom Microsoft Sentinel workbook named Workbook1.
You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows.
What should you do?
To ensure that a grid in Workbook1 contains a maximum of 100 rows, you should include the take operator in the grid query. The take operator explicitly limits the number of rows returned by the query, which is exactly what is needed to adhere to the requirement of having a maximum of 100 rows in the grid.
A. In the grid query, include the take operator. The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows. For example, you could use the following query: | take 100
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/takeoperator
Why do I pay for this, if they can't even refresh the correct answers... even after 1 year of the correct answer being in the discussion...
Since a grid in a Sentinel workbook is based on a query, the size of the grid can be set by limiting the number of query results using the take parameter(Answer A).
A. In the grid query, include the take operator. By including the take operator in the grid query, we can limit the number of rows displayed to a maximum of 100. The take operator allows us to specify the number of rows to retrieve from the data source.
D. "By default, grids only display the first 250 rows of data. This setting can be changed in the query component's advanced settings to display up to 10,000 rows. Any further items are ignored, and a warning appears." https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-limits
They only want 100. You need to limit the rows not go up.
"Up to 10.000 rows" means <= 10.000 rows, therefore you can probably reduce the number of rows too
A. Take operator: returns up to the specified number of rows.
Correct Option
the option is D:
D The take operator will always return 100 rows.
So, why did you select D...?