Azure Log Analytics- Data Retention

2 MIN READ

The Log Analytics tool collects data from a wide range of sources and uses an advanced query language to give you insight into your applications and resources.
The cost of Log Analytics depends on the pricing tier, data retention, and the solution used.

In this section, let’s see how we can increase and decrease the retention days for Log Analytics Workspace.

Steps for the retention period.

Step 1: Log into Azure Portal

Step 2: Navigate to Log Analytics Workspace ( select your workspace)

Azure Log Analytics- Data Retention

Step 3: And under General>> Click Usage and estimated costs.

Click Usage and estimated costs

Step 4: Under usage and estimated cost select data retention.

Under usage and estimated cost select data retention

Data retention by default is set as 30 days you can change it according to your need.

Set Data retention

Note: Insight data types are retained for 90 days by default, using workspace retention if they are over 90 days old.

Step 5: Click OK to save your changes.

If you want to set the different retention per table, then follow the below steps.

A list of important factors to consider when retaining data.

  • Changing the retention at the workspace level will change the table retention any longer on the one previously modified
  • For this, you will need to use some simple ARM commands.
  • To continue we need to know the resource id first to retrieve the Log Analytics workspace resource id.
  • To get that id navigate to resource explorer
  • Under resource explorer
  • Select your subscription and then select the resource group
Select your subscription and then select the resource group

Once you get the resource explorer click on subscription and then navigate all the resources till the one you want to operate on

Once you get the resource explorer click on subscription and then navigate all the resources

Now that we have the workspace resource-id, you just need to add the table name and API information to run the necessary command.

By running the GET command throughARMClient, passing the resource id

ARMClient.exe get “/subscriptions/9df78e42-893b-4152-b04ff80674a99c67/resourceGroups/SmartAppsCOM-rg/
providers/Microsoft.OperationalInsights/workspaces/sa-production-loganalytics/Tables/AzureDiagnostics?api-version=2017-04-26-preview”Now that we have the workspace resource-id, you just need to add the table name and API information to run the necessary command.

add the table name and API information

Now when we get the retention period we can set the retention according to our need by below the ARM command

ARMClient.exe put “/subscriptions/9df78e42-893b-4152-b04f-f80674a99c67/
resourceGroups/SmartAppsCOM-rg/providers/Microsoft.OperationalInsights/workspaces/sa-production-loganalytics/tables/InsightsMetrics?api-version=2017-04-26-preview” “{‘properties’:{‘retentionInDays’:7}}”

get the retention period

But if you want to set it back. You can use a null value. Use below command

ARMClient.exeput”/subscriptions/9df78e42-893b-4152-b04f-f80674a99c67/resourceGroups/SmartAppsCOM-rg/providers/Microsoft.OperationalInsights/workspaces/sa-production-loganalytics/Tables/InsightsMetrics?api-version=2017-04-26-preview” “{‘properties’:{‘retentionInDays’:null}}”

We are done with the retention period

Contact Us




    «
    »