Forum Discussion
Fromelard
May 15, 2024Steel Contributor
Azure - PowerShell script to change the Table Retention in Azure Log Analytics Workspaces
With large scale implementation of Azure, the Log Analytics Workspace volume could increase and the default value for retention is quite long if you are not changing it. This PowerShell script will ...
Fromelard
May 15, 2024Steel Contributor
After this script I also used this solution to force the purge of the biggest tables
- https://smsagent.blog/2022/01/06/purging-table-data-from-a-log-analytics-workspace/
I used the command because the API was not really working in my case:
- https://learn.microsoft.com/en-us/powershell/module/az.operationalinsights/new-azoperationalinsightspurgeworkspace?view=azps-11.6.0&viewFallbackFrom=azps-11.4.0
The script executed was :
-----
Import-module Az
Connect-AzAccount
# Az parameters
$TenantId = "qqqqqq-zzzz-wwww-yyyy-xxxxxxxxxxxx"
$Subscription = "MySubscriptionName"
$subscriptionId = "uuuuu-zzzz-wwww-yyyy-xxxxxxxxxxxx"
$ResourceGroupName = "MyResourceGroupName"
$WorkspaceName = "MyloganalyticsWorkspaceName"
# Purge parameters
$table = "ContainerLog"
$column = "TimeGenerated"
$operator = "<"
$values = "2024-01-30"
$Response = New-AzOperationalInsightsPurgeWorkspace -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -Column $column -OperatorProperty $operator -Value $values -Table $table #-key "Key"
$operationId = $Response.OperationId
----
After this you have to get the PurgeID task to execute this command and monitor the cleanup:
$Params = @{
ResourceGroupName = $ResourceGroupName
WorkspaceName = $WorkspaceName
purgeId = "purge-xxxxx-qqqq-zzzz-oooo-kkkkkkkkk" #$operationId
}
Get-AzOperationalInsightsPurgeWorkspaceStatus @params
-------
Fabrice Romelard
- https://smsagent.blog/2022/01/06/purging-table-data-from-a-log-analytics-workspace/
I used the command because the API was not really working in my case:
- https://learn.microsoft.com/en-us/powershell/module/az.operationalinsights/new-azoperationalinsightspurgeworkspace?view=azps-11.6.0&viewFallbackFrom=azps-11.4.0
The script executed was :
-----
Import-module Az
Connect-AzAccount
# Az parameters
$TenantId = "qqqqqq-zzzz-wwww-yyyy-xxxxxxxxxxxx"
$Subscription = "MySubscriptionName"
$subscriptionId = "uuuuu-zzzz-wwww-yyyy-xxxxxxxxxxxx"
$ResourceGroupName = "MyResourceGroupName"
$WorkspaceName = "MyloganalyticsWorkspaceName"
# Purge parameters
$table = "ContainerLog"
$column = "TimeGenerated"
$operator = "<"
$values = "2024-01-30"
$Response = New-AzOperationalInsightsPurgeWorkspace -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -Column $column -OperatorProperty $operator -Value $values -Table $table #-key "Key"
$operationId = $Response.OperationId
----
After this you have to get the PurgeID task to execute this command and monitor the cleanup:
$Params = @{
ResourceGroupName = $ResourceGroupName
WorkspaceName = $WorkspaceName
purgeId = "purge-xxxxx-qqqq-zzzz-oooo-kkkkkkkkk" #$operationId
}
Get-AzOperationalInsightsPurgeWorkspaceStatus @params
-------
Fabrice Romelard