Azure Log Analytics- Data Retention2 MIN READ
The Log Analytics tool collects data from a wide range of sources and uses an advanced query language to give you insight into your applications and resources.
The cost of Log Analytics depends on the pricing tier, data retention, and the solution used.
In this section, let’s see how we can increase and decrease the retention days for Log Analytics Workspace.
Steps for the retention period.
Step 1: Log into Azure Portal
Step 2: Navigate to Log Analytics Workspace ( select your workspace)
Step 3: And under General>> Click Usage and estimated costs.
Step 4: Under usage and estimated cost select data retention.
Data retention by default is set as 30 days you can change it according to your need.
Note: Insight data types are retained for 90 days by default, using workspace retention if they are over 90 days old.
Step 5: Click OK to save your changes.
If you want to set the different retention per table, then follow the below steps.
A list of important factors to consider when retaining data.
- Changing the retention at the workspace level will change the table retention any longer on the one previously modified
- For this, you will need to use some simple ARM commands.
- To continue we need to know the resource id first to retrieve the Log Analytics workspace resource id.
- To get that id navigate to resource explorer
- Under resource explorer
- Select your subscription and then select the resource group
Once you get the resource explorer click on subscription and then navigate all the resources till the one you want to operate on
Now that we have the workspace resource-id, you just need to add the table name and API information to run the necessary command.
By running the GET command throughARMClient, passing the resource id
ARMClient.exe get “/subscriptions/9df78e42-893b-4152-b04ff80674a99c67/resourceGroups/SmartAppsCOM-rg/
providers/Microsoft.OperationalInsights/workspaces/sa-production-loganalytics/Tables/AzureDiagnostics?api-version=2017-04-26-preview”Now that we have the workspace resource-id, you just need to add the table name and API information to run the necessary command.
Now when we get the retention period we can set the retention according to our need by below the ARM command
ARMClient.exe put “/subscriptions/9df78e42-893b-4152-b04f-f80674a99c67/
But if you want to set it back. You can use a null value. Use below command
We are done with the retention period