Skip to main content

Search and Performance

Search problems come in two flavors that look unrelated but share a root cause: a search that returns nothing, and a search that returns everything at great expense. Both usually mean the search is pointed at the wrong data: the wrong index, the wrong window, or an unnecessarily wide scan. This page covers diagnosing empty results, controlling investigation cost, and working within query limits.

Searches Returning Nothing​

Work down from the cheapest check to the most expensive.

Is the Data There at All?​

The first bisect: drop all filters and search a narrow recent window on the target index. If that returns nothing, this is an ingest problem; go to No Data Arriving. If it returns rows, the problem is in the query.

Index Selection​

The Data lake index drop-down (at the left of the search bar on Datalake Search) determines what is searched at all. Data that landed in a per-source index will not appear in a search of the default index. Click the drop-down to list the indexes configured for your organization: managed-default plus indexes such as managed-MSEntra and managed-behavior, as in the example below.

Data lake index drop-down open, listing the managed-MSEntra, managed-behavior and managed-default indexes with managed-default selected

Choosing a different index redraws the histogram for that index straight away; the results follow when you press Search. The full set of indexes and which lake each belongs to is on Configuration → Data Lakes, where every index in a lake appears as its own card. Data Lakes shows every index in every lake, which is how you work out where a given source writes.

Time Range​

The most common cause of an empty result. The obvious case is too narrow a window. The subtle one is that an event's timestamp is the source's, not its arrival time, so a source with clock skew or a wrong timezone lands outside the window you are looking at; the Time Adjustment recipe is the fix.

Facet Filters Still Applied​

Facet selections left over from a previous search silently narrow the current one.

On Datalake Search, each active filter appears as a chip between the toolbar and the histogram, naming the field group and the value (Event Types: ServicePrincipalSignInLogs, for example); an excluding filter is shown in red and starts with NOT. The × on a chip removes that filter, and Clear all beside the chips removes them all; then press Search to run the search without them. The facet currently loaded is named in the FACET drop-down at the top of the Filters panel.

Event Types group with ServicePrincipalSignInLogs ticked, and an Event Types: ServicePrincipalSignInLogs chip with Clear all above the histogram

See Facets.

Searches That Cost Too Much​

Where Cost Comes From​

Cost follows bytes scanned, not rows returned. Everything else follows from that: narrow the scan, not the output.

Reading the Cost Estimate​

Datalake Search sizes every search before running it. A search that would scan more data than the page runs directly (over 50 GB) opens the Investigation Search dialog instead, which previews the scope and cost of running the search as an investigation before you start it. It shows the Start time and End time to be searched and the Query the investigation will run, then Events, Search size, Estimated time, Archive files, and Estimated cost (the last an estimated dollar figure).

Run Investigation starts the run; Close dismisses the dialog without running it, which makes this a free estimate. Once the run completes, View Results loads its results on the page, and the run is listed on Admin console → Investigation History with its cost.

Reducing the Scan​

The techniques that actually help, in order of effect: shrink the time range, select a specific index, filter on indexed fields before free-text matching, and avoid leading wildcards.

Archive Searches​

Archive Files Count (v2: Archive files) in the same preview is the number of archive files a search will cover. Read it next to Size of Search and Search Cost (v2: Search size and Estimated cost) rather than on its own: the three move together, and a count above zero is the signal that the run reaches beyond the immediately searchable data. Narrowing the time range is the control that brings it down.

Tracking Spend​

Watch the Search and Realtime search figures on the Usage Report (open Reports in the navigation rail and click the report's card) to see whether search volume is trending up and which days are responsible. 7D, 30D, and 90D set the range; the Daily volume chart plots each day's Ingress, Search, and Realtime search, with checkboxes beneath it to show or hide each line, and the Daily usage table gives the same figures day by day. The cost of each investigation run is in the Cost column of Admin console → Investigation History.

Usage Report over seven days, with the Eventwatch, Datalake, Search, and Realtime search totals, the Daily volume chart, and the Daily usage table

Last updated on