Custom log retention

%3CLINGO-SUB%20id%3D%22lingo-sub-239634%22%20slang%3D%22en-US%22%3ECustom%20log%20retention%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-239634%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Everyone%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20facing%20an%20issue%20when%20trying%20to%20query%20my%20custom%20log%20data%20using%20the%20OMS%20Portal%20and%20the%20Log%20Search%20via%20Azure%20Portal.%20Although%20I%20have%20been%26nbsp%3Bsending%20logs%20for%20the%20last%203%20weeks%2C%20the%20query%20only%20shows%201%20week%20old%20data.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20number%20of%20results%2C%20displayed%20under%20the%20search%20box%20on%20the%20left%2C%20keeps%20changing%20as%20well%20when%20I%20query.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20this%20mean%20that%20my%20older%20data%20has%20been%20deleted%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-239634%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241140%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20log%20retention%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241140%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Arun%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBilly%20is%20stated%20correct%20here%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFirst%20make%20sure%20what%20is%20your%20data%20retention%20period.%20You%20can%20check%20this%20by%20going%26nbsp%3BHome-%26gt%3B%20Log%20Analytics-%26gt%3B%20Workspacename%20-%26gt%3B%20Usage%20and%20estimated%20costs%20-%26gt%3B%26nbsp%3B%3CSPAN%3EData%20volume%20management.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241084%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20log%20retention%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241084%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Arun%2C%3C%2FP%3E%3CP%3Eif%20you%20are%20not%20getting%20more%20than%207%20days%20of%20data%20it%20is%20likely%20that%20it%20is%20gone.%3C%2FP%3E%3CP%3Ewhat%20type%20of%20subscription%20are%20you%20using%3F%20I%20have%20one%20that%20I%20only%20have%207%20days%20retention%2C%20my%20other%20is%2030%20days.%20If%20you%20are%20using%20a%20full%20azure%20subscription%20you%20can%20change%20the%20retention%20period%20on%20your%20log%20analytics%20workspace.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hello Everyone,

 

I am facing an issue when trying to query my custom log data using the OMS Portal and the Log Search via Azure Portal. Although I have been sending logs for the last 3 weeks, the query only shows 1 week old data. 

 

The number of results, displayed under the search box on the left, keeps changing as well when I query.

 

Does this mean that my older data has been deleted?

 

Thanks.

 

2 Replies
Highlighted

Hi Arun,

if you are not getting more than 7 days of data it is likely that it is gone.

what type of subscription are you using? I have one that I only have 7 days retention, my other is 30 days. If you are using a full azure subscription you can change the retention period on your log analytics workspace.

Highlighted

Hi Arun,

 

Billy is stated correct here,

 

First make sure what is your data retention period. You can check this by going Home-> Log Analytics-> Workspacename -> Usage and estimated costs -> Data volume management.