Bound every log-query branch before trusting a short displayed time range

Source facts

Azure Monitor Logs partitions data by TimeGenerated. Microsoft’s optimization guidance requires a time filter in each subquery: a recent-data filter on one join input does not automatically bound another input. Its example shows an unbounded latest-record aggregation scanning the other table’s history. Filtering after a union can likewise leave earlier branch scans unbounded. Microsoft Learn.

The measured scan span can exceed the requested interval because entire storage partitions are read. In multi-region or multi-workspace queries, that indicator can also cover only part of the execution. It is not an exact global measure of the requested window. Microsoft Learn.

Applicability

Review Azure Monitor Logs queries containing joins, unions or other subqueries, especially when the same query moves between interfaces. Identify whether each branch should retrieve recent activity or an older last-known state before changing its scope.

DSE recommendation

DSE recommends annotating the intended time window beside each table reference during query review. Where the branches should share a boundary, use one clearly defined cutoff consistently. Do not discard an intentionally older state record merely to make a performance number smaller. Ask the investigation owner to approve any change in the question being answered.

Verification

Compare results before and after the proposed filters over a known dataset. Inspect the query’s processed time span and execution details while allowing for partition and cross-workspace measurement limitations. Check records near the boundary and known older state records. Retain both the semantic comparison and performance observations before promoting the revised query.

Official references

Microsoft Learn: Optimize log queries.