CertKeen

Fabric Analytics Engineer (DP-600) · Free practice question 4 of 12

Distinct and conditional counts in KQL

A KQL table named SignIns has Timestamp, UserId and Result columns. For each hour of the last seven days, you need the number of distinct users and the number of sign-ins with Result equal to Failed. Which query should you use?

  1. A.SignIns | where Timestamp > ago(7d) | summarize Users = dcount(UserId), Failures = countif(Result == "Failed") by bin(Timestamp, 1h)
  2. B.SignIns | where Timestamp > ago(7d) | summarize Users = count(UserId), Failures = count() by bin(Timestamp, 1h)
  3. C.SignIns | where Timestamp > ago(7d) and Result == "Failed" | summarize Users = dcount(UserId), Failures = count() by bin(Timestamp, 1h)
  4. D.SignIns | where Timestamp > ago(7d) | summarize Users = dcount(UserId), Failures = countif(Result == "Failed") by Timestamp
Show answer and explanation

Correct answer: A. SignIns | where Timestamp > ago(7d) | summarize Users = dcount(UserId), Failures = countif(Result == "Failed") by bin(Timestamp, 1h)

Why: dcount returns the number of distinct users, and countif counts only rows that meet a condition, so both metrics can be computed in one summarize per hourly bin. Filtering to failed rows first would restrict the distinct user count to users who failed. count(UserId) counts rows rather than distinct users, and grouping by the raw Timestamp doesn't produce hourly buckets.

More free Fabric Analytics Engineer (DP-600) questions