Search across long time spans in large datasets
Use a search job when you start an investigation to find specific events in logs up to seven years ago. You can search events across all your logs, including events in Analytics, Basic, and Archived log plans. Filter and look for events that match your criteria.
For more information on search job concepts and limitations, see Start an investigation by searching large datasets and Search jobs in Azure Monitor.
Search jobs across certain data sets might incur extra charges. For more information, see Microsoft Sentinel pricing page.
Important
Microsoft Sentinel is now generally available within the Microsoft unified security operations platform in the Microsoft Defender portal. For more information, see Microsoft Sentinel in the Microsoft Defender portal.
Start a search job
Go to Search in Microsoft Sentinel from the Azure portal or the Microsoft Defender portal to enter your search criteria. Depending on the size of the target dataset, search times vary. While most search jobs take a few minutes to complete, searches across massive data sets that run up to 24 hours are also supported.
For Microsoft Sentinel in the Azure portal, under General, select Search.
For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Search.Select the Table menu and choose a table for your search.
In the Search box, enter a search term.
Select the Start to open the advanced Kusto Query Language (KQL) editor and preview of the results for a set time range.
Change the KQL query as needed and select Run to get an updated preview of the search results.
When you're satisfied with the query and the search results preview, select the ellipses ... and toggle Search job mode on.
Select the appropriate Time range.
Resolve any KQL issues indicated by a squiggly red line in the editor.
When you're ready to start the search job, select Search job.
Enter a new table name to store the search job results.
Select Run a search job.
Wait for the notification Search job is done to view the results.
View search job results
View the status and results of your search job by going to the Saved Searches tab.
In Microsoft Sentinel, select Search > Saved Searches.
On the search card, select View search results.
By default, you see all the results that match your original search criteria.
To refine the list of results returned from the search table, select Add filter.
As you're reviewing your search job results, select Add bookmark, or select the bookmark icon to preserve a row. Adding a bookmark allows you to tag events, add notes, and attach these events to an incident for later reference.
Select the Columns button and select the checkbox next to columns you'd like to add to the results view.
Add the Bookmarked filter to only show preserved entries.
Select View all bookmarks to go the Hunting page where you can add a bookmark to an existing incident.
Next steps
To learn more, see the following articles.