Microsoft Sentinel

Search for Specific Events Across Large Datasets in Microsoft Sentinel

4 September 2026Doc update+10 / −12 lines

In brief

The article title, metadata, and related-content heading were refreshed. It also clarifies that default results apply to the selected search job and updates the related-link labels.

What Defender admins need to know

Administrators should use the revised wording and links when referencing Search jobs guidance. No required configuration change or deadline is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Search for ~~specific events across large datasets~~Specific Events Across Large Datasets in Microsoft Sentinel description: Learn how to use search jobs to search large datasets. ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to ms.date: ~~06/15/~~07/02/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security ms.custom: sfi-image-nochange, msecd-doc-authoring-~~1014~~1016 ai-usage: ai-assisted

Search for specific events across large datasets in Microsoft Sentinel

Use a search job to retrieve data stored in long-term retention, or to scan through large volumes of data, if the log query time-out of 10 minutes isn't sufficient. A search job scans through up to a year of data in a table for specific events. The search job sends its results to a new Analytics table in the same workspace as the source data.

This article explains how to run a search job in Microsoft Sentinel and how to work with the search job results.

Start a search job

Go to Search in Microsoft Sentinel from the Azure portal or the Microsoft Defender portal to enter your search criteria. Depending on the size of the target dataset, search times vary. While most search jobs take a few minutes to complete, searches across massive data sets that run up to 24 hours are also supported.

For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Search. For Microsoft Sentinel in the Azure portal, under General, select Search.
Change the KQL query as needed and select Run to get an updated preview of the search results. Resolve any KQL issues indicated by a squiggly red line in the editor.
:::image type="content" source="media/search-jobs/search-job-advanced-kql-edit.png" alt-text="Screenshot of KQL editor with revised search.":::
When you're satisfied with the query and the search results preview, select the ellipses ... and select Search job to open the Search Job Mode window.
:::image type="content" source="media/search-jobs/search-job-advanced-kql-ellipsis.png" alt-text="Screenshot of KQL editor with revised search with ellipsis highlighted in order to select Search job, which will open the Search Job Mode window." lightbox="media/search-jobs/search-job-advanced-kql-ellipsis.png":::
:::image type="content" source="media/search-jobs/view-search-results.png" alt-text="Screenshot that shows the link to view search results at the bottom of the search job card." lightbox="media/search-jobs/view-search-results.png":::
By default, you see all the results that match the criteria used for ~~that~~the selected search job.
To refine the list of results returned from the search table, select Add filter.
Add the Bookmarked filter to only show preserved entries.
Select View all bookmarks to go the Hunting page where you can add a bookmark to an existing incident.

Next stepsRelated content

~~To learn more, see the following articles.~~

@@ -1,16 +1,16 @@ ----title: Search for specific events across large datasets in Microsoft Sentinel+title: Search for Specific Events Across Large Datasets in Microsoft Sentinel description: Learn how to use search jobs to search large datasets. ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/02/2026 appliesto:     - Microsoft Sentinel in the Microsoft Defender portal     - Microsoft Sentinel in the Azure portal ms.collection: usx-security-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted  @@ -20,7 +20,7 @@ ai-usage: ai-assisted  # Search for specific events across large datasets in Microsoft Sentinel -Use a search job to retrieve data stored in [long-term retention](/azure/azure-monitor/logs/data-retention-configure#interactive-long-term-and-total-retention), or to scan through large volumes of data, if the log query time-out of 10 minutes isn't sufficient. A search job scans through up to a year of data in a table for specific events. The search job sends its results to a new Analytics table in the same workspace as the source data. +Use a search job to retrieve data stored in [long-term retention](/azure/azure-monitor/logs/data-retention-configure#interactive-long-term-and-total-retention), or to scan through large volumes of data, if the log query time-out of 10 minutes isn't sufficient. A search job scans through up to a year of data in a table for specific events. The search job sends its results to a new Analytics table in the same workspace as the source data.  This article explains how to run a search job in Microsoft Sentinel and how to work with the search job results. @@ -34,7 +34,7 @@ See [Search job considerations](/azure/azure-monitor/logs/search-jobs#considerat  ## Start a search job -Go to **Search** in Microsoft Sentinel from the Azure portal or the Microsoft Defender portal to enter your search criteria. Depending on the size of the target dataset, search times vary. While most search jobs take a few minutes to complete, searches across massive data sets that run up to 24 hours are also supported. +Go to **Search** in Microsoft Sentinel from the Azure portal or the Microsoft Defender portal to enter your search criteria. Depending on the size of the target dataset, search times vary. While most search jobs take a few minutes to complete, searches across massive data sets that run up to 24 hours are also supported.  1. For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **Microsoft Sentinel** > **Search**. For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **General**, select **Search**. @@ -53,7 +53,7 @@ Go to **Search** in Microsoft Sentinel from the Azure portal or the Microsoft De 1. Change the KQL query as needed and select **Run** to get an updated preview of the search results. Resolve any KQL issues indicated by a squiggly red line in the editor.     :::image type="content" source="media/search-jobs/search-job-advanced-kql-edit.png" alt-text="Screenshot of KQL editor with revised search.":::- + 1. When you're satisfied with the query and the search results preview, select the ellipses **...** and select **Search job** to open the **Search Job Mode** window.     :::image type="content" source="media/search-jobs/search-job-advanced-kql-ellipsis.png" alt-text="Screenshot of KQL editor with revised search with ellipsis highlighted in order to select Search job, which will open the Search Job Mode window." lightbox="media/search-jobs/search-job-advanced-kql-ellipsis.png":::@@ -76,7 +76,7 @@ View the status and results of your search job by going to the **Saved Searches*     :::image type="content" source="media/search-jobs/view-search-results.png" alt-text="Screenshot that shows the link to view search results at the bottom of the search job card." lightbox="media/search-jobs/view-search-results.png"::: -   By default, you see all the results that match the criteria used for that search job.+   By default, you see all the results that match the criteria used for the selected search job.  1. To refine the list of results returned from the search table, select **Add filter**. @@ -89,10 +89,8 @@ View the status and results of your search job by going to the **Saved Searches* 1. Add the **Bookmarked** filter to only show preserved entries. 1. Select **View all bookmarks** to go the **Hunting** page where you can add a bookmark to an existing incident. -## Next steps--To learn more, see the following articles.+## Related content -- [Hunt with bookmarks](bookmarks.md)-- [Restore logs from long-term retention](restore.md)+- [Keep track of data during hunting with Microsoft Sentinel](bookmarks.md)+- [Restore archived logs from search](restore.md) - [Manage data retention in a Log Analytics workspace](/azure/azure-monitor/logs/data-retention-configure)