Today we are going to cover how to change an individual tables data retention. I am not the first to write about this, but this is my take on things. I will also be referring to other sites to pull information from and also acknowledge those sites. There are many use cases for this, but enough of that lets get to it.
First we need an ARM template. There are other methods to do this, but I am going to stick with ARM. The following site is the original content creator. I have also created a repository for you to get it from.
First import the workbook. If you do not know how to do that here is a great article on how-to.
Once you do that the workbook will look like the following
You will notice that you can see the global retention for the Log Analytics Workspace. You will need to select which LA workspace you want to work with.
Under Report Option you can either select Full List or View by Table
I usually pick “View by Table”. If you pick a table that has not been changed it will show like this.
Now lets change the table retention for LinuxAuditLog. its important to know the name as it is in within LA.
Go to Custom Deployment in the Azure Portal
Click on Build your own template in the editor
Now just delete what is in there and copy over the arm template. I always suggest to open up in RAW view and copy it from there.
It will look something like this
Click Save, after you do that, the screen will show this.
Fill out the form. It will look something like this
Click Review and Create, Create. Should look something like this once it is complete.
Now go back into the Saved Workbook and pick the workspace and the table and view the results
This was just one method and a quick how-to. Hope you enjoyed it.