Run search jobs in Azure Monitor

To run a search job, in the Azure portal:

1. From the Log Analytics workspace menu, select Logs.

2. Type a search job query or just select the table you want.

3. Select the ellipsis menu on the right-hand side of the screen and select Search job.

   

4. Specify the search job date range using the time picker. The maximum range is one year, but can be any one year period the data retention period allows.

   If your Kusto query also specifies a time range, the union of the time ranges is used for the search job.

   

5. Enter a name for the search job result table and select Run a search job.

   Azure Monitor Logs runs the search job and creates a new table in your workspace for your search job results.

6. When the new table is ready, select View '<searchtablename>_SRCH' to view the table in Log Analytics.

   Search job results are available as they begin flowing into the newly created search job results table.

   

   Azure Monitor Logs shows a Search job is done message when it's completed. When you see that message or the progress shows 100%, the results table is now ready with all the records that match the search query.

To run a search job, call the Tables - Create or Update API. The call includes the name of the results table to be created. The name of the results table must end with _SRCH.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/<TableName>_SRCH?api-version=2021-12-01-preview

Request body

Include the following values in the body of the request:

Sample request

This example creates a table called Syslog_suspected_SRCH with the results of a query that searches for particular records in the Syslog table.

Request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/testRG/providers/Microsoft.OperationalInsights/workspaces/testWS/tables/Syslog_suspected_SRCH?api-version=2021-12-01-preview

Request body

{
    "properties": { 
        "searchResults": {
                "query": "Syslog | where * has 'suspected.exe'",
                "limit": 1000,
                "startSearchTime": "2020-01-01T00:00:00Z",
                "endSearchTime": "2020-01-31T00:00:00Z"
            }
    }
}

Response

Status code: 202 accepted.

To run a search job, run the az monitor log-analytics workspace table search-job create command. The name of the results table, which you set using the --name parameter, must end with _SRCH.

Example

az monitor log-analytics workspace table search-job create --subscription ContosoSID --resource-group ContosoRG  --workspace-name ContosoWorkspace --name HeartbeatByIp_SRCH --search-query 'Heartbeat | where ComputerIP has "00.000.00.000"' --limit 1500 --start-search-time "2022-01-01T00:00:00.000Z" --end-search-time "2022-01-08T00:00:00.000Z" --no-wait

To run a search job, run the New-AzOperationalInsightsSearchTable command. The name of the results table, which you set using the TableName parameter, must end with _SRCH.

Example

New-AzOperationalInsightsSearchTable -ResourceGroupName ContosoRG -WorkspaceName ContosoWorkspace -TableName HeartbeatByIp_SRCH -SearchQuery "Heartbeat" -StartSearchTime "01-01-2022 00:00:00" -EndSearchTime "01-01-2022 00:00:00"

1. From the Log Analytics workspace menu, select Logs.

2. From Tables > Search results, hover over your search results table to view the progress.

   The icon on the search job results table displays an update indicator icon until the search job is completed.

   

Call the Tables - Get API to get the status and details of a search job:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/<TableName>_SRCH?api-version=2021-12-01-preview

Table status

Each search job table has a property called provisioningState, which can have one of the following values:

Sample request

This example retrieves the table status for the search job in the previous example.

Request

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/testRG/providers/Microsoft.OperationalInsights/workspaces/testWS/tables/Syslog_SRCH?api-version=2021-12-01-preview

Response

{
        "properties": {
        "retentionInDays": 30,
        "totalRetentionInDays": 30,
        "archiveRetentionInDays": 0,
        "plan": "Analytics",
        "lastPlanModifiedDate": "Mon, 01 Nov 2021 16:38:01 GMT",
        "schema": {
            "name": "Syslog_SRCH",
            "tableType": "SearchResults",
            "description": "This table was created using a Search Job with the following query: 'Syslog | where * has 'suspected.exe'.'",
            "columns": [...],
            "standardColumns": [...],
            "solutions": [
                "LogManagement"
            ],
            "searchResults": {
                "query": "Syslog | where * has 'suspected.exe'",
                "limit": 1000,
                "startSearchTime": "Wed, 01 Jan 2020 00:00:00 GMT",
                "endSearchTime": "Fri, 31 Jan 2020 00:00:00 GMT",
                "sourceTable": "Syslog"
            }
        },
        "provisioningState": "Succeeded"
    },
    "id": "subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/testRG/providers/Microsoft.OperationalInsights/workspaces/testWS/tables/Syslog_SRCH",
    "name": "Syslog_SRCH"
}

To check the status and details of a search job table, run the az monitor log-analytics workspace table show command.

Example

az monitor log-analytics workspace table show --subscription ContosoSID --resource-group ContosoRG --workspace-name ContosoWorkspace --name HeartbeatByIp_SRCH --output table \

To check the status and details of a search job table, run the Get-AzOperationalInsightsTable command.

Example

Get-AzOperationalInsightsTable -ResourceGroupName "ContosoRG" -WorkspaceName "ContosoWorkspace" -tableName "HeartbeatByIp_SRCH"