Workspace Purge - Purge

  • Reference
Service:
Log Analytics
API Version:
2020-08-01

Purges data in an Log Analytics workspace by a set of user-defined filters.

In order to manage system resources, purge requests are throttled at 50 requests per hour. You should batch the execution of purge requests by sending a single command whose predicate includes all user identities that require purging. Use the in operator to specify multiple identities. You should run the query prior to using for a purge request to verify that the results are expected.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/purge?api-version=2020-08-01

URI Parameters

Name In Required Type Description
resourceGroupName
 path True
  • string

The name of the resource group. The name is case insensitive.
subscriptionId
 path True
  • string

The ID of the target subscription.
workspaceName
 path True
  • string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version
 query True
  • string

The API version to use for this operation.

Request Body

Name Required Type Description
filters True

The set of columns and filters (queries) to run over them to purge the resulting data.
table True
  • string

Table from which to purge data.

Responses

Name Type Description
202 Accepted

Accepted request for purging an Log Analytics workspace.

Headers

  • x-ms-status-location: string

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

WorkspacePurge

Sample Request

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/OIAutoRest5123/providers/Microsoft.OperationalInsights/workspaces/aztest5048/purge?api-version=2020-08-01
Request Body
{
  "table": "Heartbeat",
  "filters": [
    {
      "column": "TimeGenerated",
      "operator": ">",
      "value": "2017-09-01T00:00:00"
    }
  ]
}

Sample Response

Status code:
202 
x-ms-status-location: https://management.azure.com/subscriptions/b96161de-b34a-480f-7343-59b099299283/resourceGroups/example/providers/microsoft.operationalinsights/workspaces/test/operations/purge-970318e7-b859-4edb-8903-83b1b54d0b74?api-version=2020-08-01
Response Body
{
  "operationId": "7d7cf277-9113-4ab3-8359-d0364b74d01d"
}

Definitions

WorkspacePurgeBody

Describes the body of a purge request for an App Insights Workspace
WorkspacePurgeBodyFilters

User-defined filters to return data which will be purged from the table.
WorkspacePurgeResponse

Response containing operationId for a specific purge action.

WorkspacePurgeBody

Describes the body of a purge request for an App Insights Workspace

Name Type Description
filters

The set of columns and filters (queries) to run over them to purge the resulting data.
table
  • string

Table from which to purge data.

WorkspacePurgeBodyFilters

User-defined filters to return data which will be purged from the table.

Name Type Description
column
  • string

The column of the table over which the given query should run
key
  • string

When filtering over custom dimensions, this key will be used as the name of the custom dimension.
operator
  • string

A query operator to evaluate over the provided column and value(s). Supported operators are ==, =~, in, in~, >, >=, <, <=, between, and have the same behavior as they would in a KQL query.
value

the value for the operator to function over. This can be a number (e.g., > 100), a string (timestamp >= '2017-09-01') or array of values.

WorkspacePurgeResponse

Response containing operationId for a specific purge action.

Name Type Description
operationId
  • string

Id to use when querying for status for a particular purge operation.