Log analytics workspace archive restore data not working

Question

Hi, I'm trying to access data older than 1 month from a Log Analytics Workspace where the total retention period is as follows:

I've been following this guide from MS docs: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/restore?tabs=api-1

But when I tried to query the data from the "Restored logs" type table the the output is always empty. Am I doing something wrong? Please advise.

Answer 1

Hi Alejandro Ochoa
To Restore the logs in Azure Monitor, please follow the below steps

1)Query Time Range: Restored logs retain their original timestamps. When you run a query on restored logs, set the query time range based on when the data was originally generated.

Set the query time range by either:

• Selecting Custom in the Time range dropdown at the top of the query editor and setting From and To values. or

Specifying the time range in the query. For example:

let startTime =datetime(01/01/2022 8:00:00 PM);
let endTime =datetime(01/05/2022 8:00:00 PM);
TableName_RST
| where TimeGenerated between(startTime .. endTime)

2)Restore Operation Status

Ensure the restore operation completed successfully. The provisioningState for the restored table should be Succeeded. If it is still Updating or failed, the data will not be available for query

3)Correct Table Name

Make sure you are querying the restored table with the correct name (it must end with _RST), and that it matches the destination table name you specified in the restore API call

4)Source Table and Time Range

Double-check that the source table and the time range you restored actually contain data. If the source table was empty for that period, the restored table will also be empty.

5)Table Type Limitation

If your table is an Auxiliary table, restore is not supported. In that case, you must use a Search job instead of restore

6)Permissions

To restore data from long-term retention, you need Microsoft.OperationalInsights/workspaces/tables/write and Microsoft.OperationalInsights/workspaces/restoreLogs/write permissions to the Log Analytics workspace, for example, as provided by the Log Analytics Contributor built-in role.

Reference link:

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/restore?tabs=api-1

Please let me know if you face any challenge here, I can help you to resolve this issue further

Provide your valuable Comments.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.