[Launched] Generally Available: Search Job Enhancements in Log Analytics

Azure Monitor Log Analytics has launched significant enhancements to Search Jobs, making large-scale data exploration faster, easier, and more efficient[1]. A Search Job runs asynchronous queries on large datasets in your Log Analytics workspace, including long-term retention data, splitting queries into smaller time-based segments processed in parallel for scalability over petabyte-scale data[1].

Key improvements include:

• A more intuitive and streamlined UI for quicker and simpler job setup.
• A cost estimation preview before running a job to help manage expenses.
• Removed limits that previously restricted result sizes and concurrency; now supporting up to 100 million records and allowing more parallel jobs.
• Lifted the date-range limit, so queries can cover any time span within the data retention period, with no upper bound[1].

Usage involves running a search job query in the Log Analytics workspace via the Azure portal, which creates a new "search results" table in your workspace to hold the query results. Results flow into this table as the job progresses, and once complete, the data is available for further analysis or querying[2][3].

These improvements facilitate more powerful and flexible querying capabilities, especially for analyzing vast amounts of telemetry and log data with reduced time and operational constraints. Microsoft plans ongoing enhancements such as broader support for Kusto Query Language (KQL) operators and additional features[1].

In summary, the update reflects a major advance in the Search Job experience in Azure Monitor Log Analytics, enhancing scalability, usability, and cost-awareness for querying large datasets[1][2].

อ้างอิงค์ : https://azure.microsoft.com/updates?id=498462