Datadog Log Management Fundamentals free question 7 / 10 · Domain 4: Log Analysis
When you reduce the number of subquery attribute values to match against, you choose between top and bottom. According to the documentation, on what basis do these two pick the values?
- The first and the last when the values are sorted by name
- The largest and the smallest when read as numerical values
- The values with the highest and with the lowest frequency
- The newest and the oldest by the last time the value appeared
Show the answer and explanation
Answer: C
Why this is correct
The section "Filter logs with subqueries" says that you can optionally reduce the number of subquery attribute values to match against, and: "Choose between top (highest frequency values) or bottom (lowest frequency values)." When the subquery returns too many values, you can keep the values that appear most often, or the ones that appear rarely.
Why the other options are wrong
"The newest and the oldest by the last time the value appeared" … The step defines top and bottom by frequency, as highest frequency values and lowest frequency values. How recently a value appeared is not the basis.
"The largest and the smallest when read as numerical values" … Top and bottom are set by how often a value appears, not by its size, so the choice works in the same way for string attributes.
"The first and the last when the values are sorted by name" … The step defines top and bottom by frequency. Sorting by name does not decide which values are kept.
Design tip
Use top when you want to match against your most active users, for example the top users of another service, and bottom when you want to match against values that appear only rarely. Remember the mechanism, choosing by frequency of the values.