diff --git a/articles/azure-monitor/logs/workspace-replication.md b/articles/azure-monitor/logs/workspace-replication.md index d9521b2e3f..19e98e57fe 100644 --- a/articles/azure-monitor/logs/workspace-replication.md +++ b/articles/azure-monitor/logs/workspace-replication.md @@ -310,22 +310,29 @@ The `POST` command is a long running operation that can take some time to comple ## Audit the inactive workspace -By default, Azure Monitor run queries in your _active_ region. The active region is typically your primary region in your primary workspace. During switchover, the secondary workspace becomes _active_ and the primary region is _inactive_. +By default, your workspace’s active region is the region where you create the workspace, and the inactive region is the secondary region, where Azure Monitor creates the replicated workspace. -In some cases, you might want to query the _inactive_ region. For example, you might want to ensure that your secondary workspace has complete replication of ingested logs before you switch over. +When you trigger failover, this switches – the secondary region is activated, and primary region becomes inactive. We say it's inactive because it’s not the direct target of log ingestion and query requests. + +It's useful to query the inactive region before you switch between regions to verify that the workspace in the inactive region has the logs you expect to see there. ### Query inactive region -To query the available logs on the inactive workspace: +To query log data in the inactive region, use this GET command: -1. In the Azure portal, go to your Log Analytics workspace. -1. On the left, select **Logs**. -1. On the query toolbar, select **More tools** (...) at the right. -1. Enable **Query inactive region**. +```http +GET + +api.loganalytics.azure.com/v1/workspaces//query?query=×pan=&overrideWorkspaceRegion= +``` - :::image type="content" source="media/workspace-replication/query-inactive-region.png" alt-text="Screenshot that shows how to query the inactive region through the workspace Logs page in the Azure portal." lightbox="media/workspace-replication/query-inactive-region.png"::: +For example, to run a simple query like `Perf | count` for the past day in your secondary region, use: -After you enable the **Query inactive region** option, Log Analytics shows query results for the inactive region rather than the active region. +```http +GET + +api.loganalytics.azure.com/v1/workspaces//query?query=Perf%20|%20count×pan=P1D&overrideWorkspaceRegion=secondary +``` You can confirm that Azure Monitor runs your query in the intended region by checking these fields in the `LAQueryLogs` table, which is created when you [enable query auditing in your Log Analytics workspace](query-audit.md):