I know that there is a limit of 30,000 items for the results in the Log Analytics Workspace but is there a work around to get more than just 30000 results?

@Jean Paul Luna [jean_paulluna] Welcome to Microsoft Q & A Community Forum. I understand you are trying to retrieve more than 30,000 records from LA workspace which is max limit. I would suggest you to try querying your Azure monitor data using Azure Data Explorer. Traverse to https://dataexplorer.azure.com/ -> Click on Add Cluster -> Add link of LA workspace in the format https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name> -> Choose convenient Display Name -> Click Ok. After adding it , try querying the data using kusto query language which is same language that is used to query LA workspaces. Reference : https://learn.microsoft.com/en-us/azure/data-explorer/query-monitor-data

@SwathiDhanwada-MSFT I just realized that our organization doesn't have any Azure Data Explorer Clusters configured. Thanks for pointing me to the right direction. I appreciate it!

@SwathiDhanwada-MSFT Another question if I may. If I were to use logic apps to send me an automated email that contains a .csv file using the same query that I am now using, would the file attachment still only have a hard limit of 30,000 results? Thanks!

How to view more than 30000 items in Azure Log Analytics Workspace?

Accepted answer

SwathiDhanwada-MSFT 17,881 Reputation points

2022-02-22T17:28:49.433+00:00

@Jean Paul Luna [jean_paulluna] Welcome to Microsoft Q & A Community Forum. I understand you are trying to retrieve more than 30,000 records from LA workspace which is max limit. I would suggest you to try querying your Azure monitor data using Azure Data Explorer.

Traverse to https://dataexplorer.azure.com/ -> Click on Add Cluster -> Add link of LA workspace in the format https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name> -> Choose convenient Display Name -> Click Ok.

After adding it , try querying the data using kusto query language which is same language that is used to query LA workspaces.

Reference : https://learn.microsoft.com/en-us/azure/data-explorer/query-monitor-data
Please sign in to rate this answer.

1 person found this answer helpful.
Jean Paul Luna [jean_paulluna] 21 Reputation points

2022-02-22T17:59:19.42+00:00

@SwathiDhanwada-MSFT Thank you for the response. I don't have permission to create an Azure Data Explorer Cluster but that's a good start for me. I am querying some security logs from one of our SQL clusters and exporting them out as a CSV file that are then stored to a database on prem, but there are weeks where there are more than 30,000 results and I am forced to query the result by batches. I appreciate your help!

SwathiDhanwada-MSFT 17,881 Reputation points

2022-02-23T05:15:09.96+00:00

@Jean Paul Luna [jean_paulluna] You wouldn't need to create a new cluster. You are just trying to access the log analytics from azure data explorer. For this, you wouldn't require any permissions to do so. May I know if the Add Cluster tab is disabled for you or are you prompted with any error ?

R, Vijayaraghavan 0 Reputation points

2024-02-15T10:16:26.38+00:00

Hi, Im trying to add my LA cluster, but im not even seeing Add Cluster button itself. Is this access issue?

Sameer Bhujbal 0 Reputation points

2024-04-30T14:04:08.7633333+00:00

@R, Vijayaraghavan You need to click on Query -> Add -> Connection and enter the connection URI in https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name> format
Sign in to comment

Share via

How to view more than 30000 items in Azure Log Analytics Workspace?

2 additional answers