View/Query data in Log Storage

%3CLINGO-SUB%20id%3D%22lingo-sub-1490841%22%20slang%3D%22en-US%22%3EView%2FQuery%20data%20in%20Log%20Storage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1490841%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20a%20diagnostic%20export%20of%20audit%20and%20sign-in%20logs%20to%20both%20a%20Log%20Storage%20and%20Event%20hub%20instance%20with%20retention%20of%20365%20days%20on%20the%20storage%20account.%20I%20need%20to%20see%20the%20historical%20data%20therein.%20What%20are%20my%20options%3F%20Log%20Analytics%20only%20goes%20back%2030%20days%20currently.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1499284%22%20slang%3D%22en-US%22%3ERe%3A%20View%2FQuery%20data%20in%20Log%20Storage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1499284%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F534442%22%20target%3D%22_blank%22%3E%40shocko%3C%2FA%3E%26nbsp%3Bnot%20really%20sure%20but%20i%20think%20you%20need%20to%20ingest%20them%20into%20a%20log%20analytics%20to%20check%20the%20contents%2C%20(importing%20them%20manually)%20or%20accessing%20the%20storage%20account%20by%20using%26nbsp%3BMicrosoft%20azure%20Storage%20Explorer...%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fanswers%2Fquestions%2F25850%2Fhow-to-get-the-access-log-for-the-storage-account.html%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fanswers%2Fquestions%2F25850%2Fhow-to-get-the-access-log-for-the-storage-account.html%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%20Regards.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

We have a diagnostic export of audit and sign-in logs to both a Log Storage and Event hub instance with retention of 365 days on the storage account. I need to see the historical data therein. What are my options? Log Analytics only goes back 30 days currently. 

2 Replies

@shockotechcom not really sure but i think you need to ingest them into a log analytics to check the contents, (importing them manually) or accessing the storage account by using Microsoft azure Storage Explorer... 

 

Hope this helps: 

 

https://docs.microsoft.com/en-us/answers/questions/25850/how-to-get-the-access-log-for-the-storage-a...

 

Best Regards. 

 

 

@loadedlouie27 

You may be able to query them with the externaldata operator, which reads them into a query rather than re-ingesting them?

 

https://techcommunity.microsoft.com/t5/azure-sentinel/move-your-azure-sentinel-logs-to-long-term-sto...

See "Query the data" section.