Written
December 16, 2019
I have setup some custom log sources in my log analytics workspace and trying to archive those logs from the Poweshell script provided. There are only certain kusto queries I can run and get the logs to archive but not all. For example: I am able to archive : "SecurityEvent | where EventID == 4688 | project TimeGenerated , Computer , EventID , ParentProcessName, ProcessId, NewProcessName , NewProcessId"
However when i try with query "Search *" or "Custom_log_source_CL", I recieve error. can you please help me to know how I can archive all the logs in log analytics workspace?