You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/search-jobs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,7 +48,7 @@ Go to **Search** in Microsoft Sentinel from the Azure portal or the Microsoft De
48
48
1. When you're satisfied with the query and the search results preview, select the ellipses **...** and toggle **Search job mode** on.
49
49
50
50
:::image type="content" source="media/search-jobs/search-job-advanced-kql-ellipsis.png" alt-text="Screenshot of KQL editor with revised search with ellipsis highlighted for Search job mode." lightbox="media/search-jobs/search-job-advanced-kql-ellipsis.png":::
51
-
1.Select the appropriate **Time range**.
51
+
1.Specify the search job date range using the **Time range** selector. Don't include a time range in your KQL query as it is ignored.
52
52
1. Resolve any KQL issues indicated by a squiggly red line in the editor.
53
53
1. When you're ready to start the search job, select **Search job**.
54
54
1. Enter a new table name to store the search job results.
0 commit comments