Share via

Maximum Results in Log Analytics Workspace

Bevan L 1 Reputation point
2020-07-07T23:44:32.373+00:00

I have a query for Azure AD logs in my Log Analytics workspace as follows (IP changed):

set notruncation;
SigninLogs
| where IPAddress != '1.2.3.4' |summarize SigninCount = count() by Identity, tostring(LocationDetails.city), AppDisplayName, ClientAppUsed
|sort by Identity asc

When my results are presented I am getting an alert at the bottom of the results:

Results were limited to the first 250 rows.

How can I avoid this and present the full results?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,973 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Shikha Jain 6 Reputation points Microsoft Employee
    2020-07-14T23:09:25.05+00:00

    Workbooks are designed to create interactive reports or analysis narratives. they are not intended to be used as data explorer and moreover it is difficult to consume rows of data. So it is best to optimize filters

    Having said that you can see more than 250 rows and recommend use this with caution !
    now in order to expand the result set you can change it by going to advanced settings in edit mode and inputting the value here 12231-image.png

    12241-image.png

    1 person found this answer helpful.
    0 comments
  2. Oleg Ananiev (MSFT) 81 Reputation points Microsoft Employee
    2020-07-14T22:00:57.543+00:00

    workbooks are interactive canvases, they are not really intended to present long "sheets" of text.
    but there is a partial solution here: in edit mode, choose Advanced Settings and then select "Show open external query button when not editing"
    This will add a small Log Analytics icon in the top right corner of your table, clicking this icon will take you to Log Analytics experience, with the same query - and LA can show up to 10K records in the UX + gives you additional flexibility into analyzing the results (by changing the query or simply working with the table)

    Hope this helps