Configure Cribl Search to query log data stored in Azure Log Analytics workspaces.

In this guide, you will set up a Dataset Provider and a Dataset to search log tables in an Azure Log Analytics workspace.

Before You Start ​

Azure prerequisites:

• Create an App Registration in Microsoft Entra ID. Assign the Log Analytics Reader role to this app registration on the target Log Analytics workspace. See Microsoft’s guide to registering an application for details.
• Collect the following values from the app registration before configuring the provider:
  • Tenant ID (your Microsoft Entra tenant GUID)
  • Client ID (the application client ID)
  • Client Secret (the secret value, not the secret ID)
  • Workspace ID (the Log Analytics workspace GUID)

Network prerequisites:

• The Cribl Search Leader node must have outbound HTTPS access to api.loganalytics.io and login.microsoftonline.com.
• If your environment restricts outbound traffic, allowlist the Leader node egress IP in your firewall or network policy before saving the provider.

Add an Azure Log Analytics Dataset Provider ​

A Dataset Provider tells Cribl Search where to query and stores the access credentials for that connection.

To add a new Azure Log Analytics Dataset Provider, select Data, then Dataset Providers, then Add Provider.

Set the following configurations in the New Dataset Provider modal:

1. ID is a unique identifier for the Dataset Provider. This is how you will reference it when assigning Datasets to it. Start the ID with a letter. The rest of the ID can use letters, numbers, and underscores (for example, my_log_analytics_provider).
2. Description is optional.
3. Set Dataset Provider Type to Azure Log Analytics.
4. Enter the following values from your Microsoft Entra app registration:
   • Tenant ID is the GUID of your Microsoft Entra tenant.
   • Client ID is the GUID of the app registration.
   • Client Secret is the secret value for the app registration. Enter the secret value, not the secret ID. The secret is stored encrypted at rest.
   • Workspace ID is the GUID of the Log Analytics workspace this provider connects to.
5. Select Save when finished.

When you save the provider, Cribl Search runs an automatic connectivity check against the configured workspace. If the check fails, a message appears explaining the cause. See Connectivity Check Errors for guidance on each error type.

Connectivity Check Errors ​

The connectivity check runs a lightweight query (print 1) against the workspace with a 30-second timeout. Failures return one of the following messages:

Add an Azure Log Analytics Dataset ​

Now you will add a Dataset that tells Cribl Search which log table to query within the provider’s workspace.

To add a new Dataset, select Data, then Datasets, then Add Dataset.

Set the following configurations in the New Dataset modal:

1. Select the Dataset type: Federated Dataset.
2. ID is an identifier unique for both Cribl Search and Cribl Lake. You will use this to specify the Dataset in a query’s scope. Start the ID with a letter. The rest of the ID can use letters, numbers, and underscores (for example, my_la_dataset).
3. Description is optional.
4. Set Dataset Provider to the ID of an Azure Log Analytics provider, then configure the following fields:
   • Table or query (required) is the source of data for this Dataset. Enter a bare table name such as SecurityEvent, or a KQL expression such as SecurityEvent | where EventID in (4624, 4625). The value must not contain control commands (.drop, .clear, .delete, .alter, .create, .rename). You can include operators like extend, project, summarize, and sort in this field. When you run a Cribl Search query against this Dataset, filter conditions (such as where) are sent to Azure for server-side execution when possible, while other operations run locally on the Cribl Search Leader.
   • Timestamp field (optional, defaults to TimeGenerated) is the field promoted to the canonical _time field in Cribl Search results.
   • Timestamp field contents (optional, defaults to kusto_datetime) is the data format of the timestamp field. Select from the following options:
     • kusto_datetime: Kusto datetime scalar type (default)
     • epoch_sec: Unix epoch seconds
     • epoch_millis: Unix epoch milliseconds
     • iso_string: ISO 8601 string
5. In Processing, you can apply rules for breaking data into discrete events. For more information, see Datatypes.
6. Select Save when finished.

The Table or query field currently requires a non-empty value. Support for blank-table Datasets (where the analyst provides the full table reference in the query) is planned for a future release.

Search Azure Log Analytics ​

Now that you have a Dataset Provider and Dataset, you are ready to start searching.

dataset="my_la_dataset" | limit 1000

It can take a few moments for a search to start returning results on the first run.

Search Row Limits ​

Cribl Search enforces a 50,000 row limit per query. When the entire query can be executed on the Azure side, this limit is appended to the KQL as | limit 50000. If your query already contains a | limit clause, KQL applies whichever value is lower. When the query includes operations that run locally in Cribl Search (such as aggregations), the limit is enforced locally instead.

Microsoft enforces separate per-query limits: 500,000 rows, ~100 MB response size (~64 MB compressed), and a 3-minute query timeout. If a response hits one of these limits, Cribl Search returns the rows that were received and records a warning in the Search logs. To reduce the likelihood of truncation, add filters to your query or Dataset scope, or reduce the time range of the search.