Question

Your company retains application logs in a Log Analytics workspace for compliance. Data older than 90 days is queried only rarely for occasional audits, but must be kept for 2 years. Interactive retention is currently set to 90 days. You need to keep the older data for the full 2 years at the lowest cost while still allowing it to be searched when required. What should you configure?

Accepted Answer

Configure the table's total retention to 730 days so data moves to the low-cost archive tier after the interactive period.

Answer

Increase the interactive retention period of the table to 730 days.

Answer

Export the data to an Azure Storage account using a data export rule and delete the workspace data after 90 days.

Answer

Create a data collection rule that filters out logs older than 90 days.