Dec 25 2018
- last edited on
Apr 07 2022
I have a simple query to fetch complete computer name based on AD Site code and tried running below queries.
But certain AD sites has more that 10000 computer and only results first 10000 computername in Advanced Analytics and 5000 in Log Search.
I can't figure out how to export next 10,000 computer name from Advanced Analytics in Azure Log Analytics - there must be a simple way - but how? Can we do this and advice me in the right direction for the query to run export fetch the next 10,000 computer name from Advanced Analytics?
UAApp | project Computer, ComputerID, AppName, AppCategory , AppLanguage, Importance | where Computer contains "*LOCATIONCODE*"
UAApp | project Computer, ComputerID, AppName, AppCategory , AppLanguage, Importance | where Computer startswith "*LOCATIONCODE*"
| where ( Type == "UAApp" ) | project Computer, ComputerID, AppName, AppCategory , AppLanguage, Importance | where Computer contains "*LOCATIONCODE*"
Dec 27 2018 06:06 AMSolution
Indeed there is a 10K cap on the result set size in the UI, but there are a number of ways to handle larger result sets.
1. You can transform your results into an array, which can hold much more than 10K values. See this example, where over 40K values are put into a single array, that you can later export to excel. That would of mean you need to use excel formulas if you want to return to a tabular structure.
2. Reduce the size of your results - you can use "distinct Computer", "summarize by Computer" or "summarize makeset" to remove duplicate values from your results (Also, if all you need is that computer's name, project only that column).
3. Use the API - the 10K results limit is only a UI limitation, so if you use the API you'll always get the full result set. In your script, you can process the result set to create a CSV structure which excel can load.
Dec 27 2018 07:00 AM
Thanks for the points and I tried querying now by using distinct command and getting somehow the expected result.
ex: UAComputer | project Computer | where Computer startswith "XXXX"
Can you advice on API as said below. Whether we have the API to get the full result set?
Dec 30 2018 06:24 AM
Mar 10 2019 07:33 AM
This is a general limitation , not only for export to excel, same for PowerBI. For large tenants like more as 100k spo sites/o365 groups or Onedrive user same problem if you build runbooks or use out of the box modules like the o365 report module.
We need for example the possibility to export 150k items in flat query view.
Mar 10 2019 07:34 AM
Noa, could you please share the array example here in the post ? Access denied on your workspace.
Thanks a lot.
Oct 02 2019 04:10 AM
Oct 23 2019 05:44 AM
@Noa Kuperberg How do we convert into array if what we have is a pivot table (after using evaluate pivot()) instead normal table with normal column names?
Sep 30 2020 07:03 AM
This script does exactly what you want - export the data into a CSV. And yes, you will be able to export more than just 10.000 records.
I think the most you can export is 500.000 records actually.
As well as call rate limits and daily quota caps, there are also limits on queries themselves: