Datadog Log Management Fundamentals free question 8 / 10 · Domain 4: Log Analysis
You want to use a query filter that narrows logs with the values of a Reference Table. According to the documentation, which Reference Tables cannot be used for this filter?
- Reference Tables containing over 10,000 rows
- Reference Tables containing over 1,000,000 rows
- Reference Tables that contain over 100,000 rows
- Reference Tables containing over 1,000 rows
Show the answer and explanation
Answer: B
Why this is correct
The section "Filter logs based on Reference Tables" says: "Reference Tables containing over 1,000,000 rows cannot be used to filter events." Reference Tables let you combine metadata with logs, providing more information to resolve application issues, and a query filter based on a Reference Table performs a lookup that matches a log field against a table column. A table above this size has to be kept smaller, or split, before it can serve as such a filter.
Why the other options are wrong
"Reference Tables containing over 1,000 rows" … 1000 is the default number of subquery attribute values in the subquery filter, a different setting. The limit for Reference Tables is over 1,000,000 rows.
"Reference Tables that contain over 100,000 rows" … A table with just over 100,000 rows is still below the limit. The section sets the limit at tables containing over 1,000,000 rows.
"Reference Tables containing over 10,000 rows" … A table with just over 10,000 rows is still below the limit. The section sets the limit at tables containing over 1,000,000 rows.
Related setting
You add this filter by clicking the Add button next to the query editor and selecting Join with Reference Table, then choosing the log field and the table column to join on and the IN or NOT IN operator. When you design a large Reference Table, check first that it stays within this limit if you plan to filter logs with it.