Sentinel Watchlist "searchkey" not sticking upon creation

Question

Sentinel Watchlist "searchkey" not sticking upon creation

Josh Madakor 30

When I go to create a watchlist and set the searchkey, it automatically gets reset to "Text/Csv" and the watchlist fails to create. Please see attached image.

User's image

Josh Madakor 30 Reputation points

2025-05-14T00:32:34.35+00:00

Forgot to mention, the watchlist of course fails to create. The file has been previously used and is currently in a working watchlist.
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-14T05:46:14.0566667+00:00

Hello @Josh Madakor

Based on your description, when you try to select the search key, it automatically resets to Text/CSV.

I tested the same scenario in my environment, and this appears to be the expected behavior.

However, I understand that you are encountering an error when attempting to create.

I’d like to discuss this with you further offline to better understand your scenario. Please share your contact details via private message, along with your availability for a call.

Looking forward to connecting.
Sergey Lukashov 0 Reputation points

2025-05-14T12:19:51.3066667+00:00

Hi, I’m experiencing the same issue. I’m trying to create a watchlist using the same CSV file that's already in use in another active watchlist, but I’m now receiving the error: "Error creating watchlist."
Sergey Lukashov 0 Reputation points

2025-05-14T12:55:17.34+00:00

I discovered that the issue lies with the number of rows in the CSV file. The original file, which worked previously, contained around 50K rows, but now this many rows cannot be uploaded to Watchlists. After testing with different row counts, I found that if the file is trimmed to between 20K and 30K rows, the CSV is accepted, and the watchlist uploads successfully. Does anyone know the updated row limit for Watchlists?
Josh Madakor 30 Reputation points

2025-05-14T20:18:52.1666667+00:00

@Surya Prakash Kotte Thoughts on what @Sergey Lukashov discovered?
Josh Madakor 30 Reputation points

2025-05-14T20:22:14.86+00:00

Surya Prakash Kotte I don't know how to DM people on this platform. It looks like you have to initiate it. So you can do that I guess, or email me:xxxx
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-15T01:02:05.7566667+00:00

Hello @Josh Madakor

As Sergey mentioned, whenever you're uploading the CSV file, please ensure it follows the required format.

You can refer to the documentation below for guidance:

https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create?tabs=defender-portal
Josh Madakor 30 Reputation points

2025-05-15T02:42:20.4533333+00:00

Surya Prakash Kotte Please email me so we can do a remote session and I can show you. The file does comply. You can literally see it here for yourself here and I've literally used the file before. It just suddenly stopped woking. Anyone can try it.

hxxps://raw.githubusercontent.com/joshmadakor1/lognpacific-public/refs/heads/main/misc/geoip-summarized.csv
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-15T03:32:16.77+00:00

Hello @Josh Madakor

I have shared you the meeting invite can you please join?
Josh Madakor 30 Reputation points

2025-05-16T00:28:56.56+00:00

Thank you for the meeting Surya Prakash Kotte, just following up
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-16T05:53:32.56+00:00

Hello @Josh Madakor

Apologies for the delay. I have informed my internal team about the situation, and they are currently working on it. I will update you as soon as I receive any further information.
Josh Madakor 30 Reputation points

2025-05-16T07:25:45.9033333+00:00

Thank you so much Surya Prakash Kotte.
Rukmini 3,916 Reputation points Microsoft External Staff Moderator

2025-05-19T10:22:24.7+00:00

Hello Josh Madakor, We will check internally and update you shortly.
SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-21T04:37:53.4533333+00:00

Hello Josh Madakor,

Thank you for your patience. We've identified that the "Watchlist could not be properly saved" error is due to a backend size limit that’s currently lower than the documented 3.8MB. Files larger than about 2MB may not upload successfully.

A fix is in progress and should be available soon. In the meantime, reducing the CSV file size below 2MB can help avoid the issue.

We'll keep you updated once the fix is deployed. We appreciate your understanding.
Josh Madakor 30 Reputation points

2025-05-21T05:11:28.03+00:00

Thank you for the response.
SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-22T01:05:20.9766667+00:00

Hello Josh Madakor,

The team has finished fixing the issue with the watchlist upload. I tested it, and it’s working fine now.

Could you please try again on your side and confirm if the issue is resolved?

Thanks again for your patience.

Accepted answer

0 additional answers

Your answer

Josh Madakor 30 Reputation points

2025-05-14T00:32:34.35+00:00

Forgot to mention, the watchlist of course fails to create. The file has been previously used and is currently in a working watchlist.
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-14T05:46:14.0566667+00:00

Hello @Josh Madakor

Based on your description, when you try to select the search key, it automatically resets to Text/CSV.

I tested the same scenario in my environment, and this appears to be the expected behavior.

However, I understand that you are encountering an error when attempting to create.

I’d like to discuss this with you further offline to better understand your scenario. Please share your contact details via private message, along with your availability for a call.

Looking forward to connecting.
Sergey Lukashov 0 Reputation points

2025-05-14T12:19:51.3066667+00:00

Hi, I’m experiencing the same issue. I’m trying to create a watchlist using the same CSV file that's already in use in another active watchlist, but I’m now receiving the error: "Error creating watchlist."
Sergey Lukashov 0 Reputation points

2025-05-14T12:55:17.34+00:00

I discovered that the issue lies with the number of rows in the CSV file. The original file, which worked previously, contained around 50K rows, but now this many rows cannot be uploaded to Watchlists. After testing with different row counts, I found that if the file is trimmed to between 20K and 30K rows, the CSV is accepted, and the watchlist uploads successfully. Does anyone know the updated row limit for Watchlists?
Josh Madakor 30 Reputation points

2025-05-14T20:18:52.1666667+00:00

@Surya Prakash Kotte Thoughts on what @Sergey Lukashov discovered?
Josh Madakor 30 Reputation points

2025-05-14T20:22:14.86+00:00

Surya Prakash Kotte I don't know how to DM people on this platform. It looks like you have to initiate it. So you can do that I guess, or email me:xxxx
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-15T01:02:05.7566667+00:00

Hello @Josh Madakor

As Sergey mentioned, whenever you're uploading the CSV file, please ensure it follows the required format.

You can refer to the documentation below for guidance:

https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create?tabs=defender-portal
Josh Madakor 30 Reputation points

2025-05-15T02:42:20.4533333+00:00

Surya Prakash Kotte Please email me so we can do a remote session and I can show you. The file does comply. You can literally see it here for yourself here and I've literally used the file before. It just suddenly stopped woking. Anyone can try it.

hxxps://raw.githubusercontent.com/joshmadakor1/lognpacific-public/refs/heads/main/misc/geoip-summarized.csv
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-15T03:32:16.77+00:00

Hello @Josh Madakor

I have shared you the meeting invite can you please join?
Josh Madakor 30 Reputation points

2025-05-16T00:28:56.56+00:00

Thank you for the meeting Surya Prakash Kotte, just following up
Surya Prakash Kotte 3,125 Reputation points Microsoft External Staff Moderator

2025-05-16T05:53:32.56+00:00

Hello @Josh Madakor

Apologies for the delay. I have informed my internal team about the situation, and they are currently working on it. I will update you as soon as I receive any further information.
Josh Madakor 30 Reputation points

2025-05-16T07:25:45.9033333+00:00

Thank you so much Surya Prakash Kotte.
Rukmini 3,916 Reputation points Microsoft External Staff Moderator

2025-05-19T10:22:24.7+00:00

Hello Josh Madakor, We will check internally and update you shortly.
SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-21T04:37:53.4533333+00:00

Hello Josh Madakor,

Thank you for your patience. We've identified that the "Watchlist could not be properly saved" error is due to a backend size limit that’s currently lower than the documented 3.8MB. Files larger than about 2MB may not upload successfully.

A fix is in progress and should be available soon. In the meantime, reducing the CSV file size below 2MB can help avoid the issue.

We'll keep you updated once the fix is deployed. We appreciate your understanding.
Josh Madakor 30 Reputation points

2025-05-21T05:11:28.03+00:00

Thank you for the response.
SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-22T01:05:20.9766667+00:00

Hello Josh Madakor,

The team has finished fixing the issue with the watchlist upload. I tested it, and it’s working fine now.

Could you please try again on your side and confirm if the issue is resolved?

Thanks again for your patience.

Answer 1

SrideviM 5,715 Microsoft External Staff Moderator

Hello Josh Madakor,

The issue with the watchlist upload was caused by a backend size limit that prevented files over ~2MB from being saved, even though the documented limit was higher. This has now been fixed by the product team.

I tested the upload using your file, and it worked successfully. You should now be able to create the watchlist without any issues.

enter image description here

Please give it a try and let us know if it works for you.

Hope this helps.

If this answers your query, do click Accept Answer and Yes for Was this answer helpful, which may help members with similar questions.

User's image

If you have any other questions or are still experiencing issues, feel free to ask in the comments section, and I'd be happy to help.

SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-23T01:13:57.31+00:00

Hello Josh Madakor,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions. If you have any further query do let us know.
SrideviM 5,715 Reputation points Microsoft External Staff Moderator

2025-05-26T00:48:17.5466667+00:00

Hello Josh Madakor,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions. If you have any further query do let us know.
Josh Madakor 30 Reputation points

2025-05-29T02:17:33.6+00:00

Thank you bro. Good to go

Share via

Sentinel Watchlist "searchkey" not sticking upon creation

0 additional answers

Your answer