Skip to content

Commit 2d84694

Browse files
committed
linked to azmon limitations
1 parent 5cd7c43 commit 2d84694

File tree

2 files changed

+4
-17
lines changed

2 files changed

+4
-17
lines changed

articles/sentinel/investigate-large-datasets.md

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -47,22 +47,7 @@ You can also search analytics or basic log data stored in [long-term retention](
4747

4848
### Limitations of a search job
4949

50-
Before you start a search job, be aware of the following limitations:
51-
52-
- Optimized to query one table at a time.
53-
- Search date range is up to seven years.
54-
- Supports long running searches up to a 24-hour time-out.
55-
- Results are limited to one million records in the record set.
56-
- Concurrent execution per user is limited to five search jobs per workspace.
57-
- Limited to 100 search results tables per workspace.
58-
- Limited to 100 search job executions per day per workspace.
59-
60-
Search jobs aren't currently supported for the following workspaces:
61-
62-
- Customer-managed key enabled workspaces
63-
- Workspaces in the China East 2 region
64-
65-
To learn more, see [Search job in Azure Monitor](/azure/azure-monitor/logs/search-jobs) in the Azure Monitor documentation.
50+
See [Search job limitations](/azure/azure-monitor/logs/search-jobs#limitations) in the Azure Monitor documentation.
6651

6752
## Restore historical data from archived logs
6853

articles/sentinel/search-jobs.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@ ms.collection: usx-security
1717

1818
# Search for specific events across large datasets in Microsoft Sentinel
1919

20-
Use a search job when you start an investigation to scan through up to a year of data in a table for specific events. You can a run search job on any table, including tables with the Analytics, Basic, and Auxiliary log plans. The search job sends its results to a new Analytics table in the same workspace as the source data. This article explains how to run a search job in Microsoft Sentinel and how to work with the search job results.
20+
Use a search job when you start an investigation to scan through up to a year of data in a table for specific events. You can a run search job on any table, including tables with the Analytics, Basic, and Auxiliary log plans. The search job sends its results to a new Analytics table in the same workspace as the source data.
21+
22+
This article explains how to run a search job in Microsoft Sentinel and how to work with the search job results.
2123

2224
Search jobs across certain data sets might incur extra charges. For more information, see [Microsoft Sentinel pricing page](billing.md).
2325

0 commit comments

Comments
 (0)