Log Analytics collects data from a variety of sources and uses a powerful query language to give you insights into the operation of your applications and resources.
Log Analytics cost depends on your choice of pricing tier, data retention and which solutions are used.
In this section lets see how we can increase and decrease the retention days for Log Analytics Workspace.
Steps for retention period.
Step 1: Log into Azure Portal
Step 2: Navigate to Log Analytics Workspace ( select your workspace)
Step 3: And under General>> Click Usage and estimated costs.
Step 4: Under usage and estimated cost select data retention.
Data retention by default is set as 30 days you can change according to your need.
Note: Retention for Application insight data types default to 90 days and will get the workspace retention if it is over 90 days.
Step 5: Click on Ok to save the changes
If you want to set the different retention per table, then follow the below steps.
Important elements to be considered when dealing with data retention
- Changing the retention at workspace level will change the table retention any longer on the one previously modified
- For this you will need to use some simple ARM commands.
- To continue we need to know the resource id first to retrieve the Log analytics workspace resource id.
- To get that id navigate to resource explorer
- Under resource explorer
- Select your subscription and then select resource group
Once you get the resource explorer click on subscription and then navigate all the resources till the one you want to operate on
Now that we have the workspace resourceid, you just need to add the table name and API information to run the necessary command.
By running the GET command throughARMClient, passing the resource id
ARMClient.exe get “/subscriptions/9df78e42-893b-4152-b04ff80674a99c67/resourceGroups/SmartAppsCOM-rg/
Now when we get the retention period we can set the retention according to our need by below ARM command
ARMClient.exe put “/subscriptions/9df78e42-893b-4152-b04f-f80674a99c67/
But if you want to set it back. You can use null value. Use below command
We are done with the retention period