Drop the Retention Period Down under 30 days

az monitor log-analytics workspace table update –subscription %SubscriptionID% –resource-group %resourcegroup% –workspace-name %workspacename% –name AzureDiagnostics –retention-time 4 –total-retention-time 4

1. Try via here https://learn.microsoft.com/en-us/rest/api/loganalytics/workspace-purge/purge?tabs=HTTP&tryIt=true&source=docs#code-try-0
   
   Give yourself the Data Purger Role for the workspace

Enter resourceGroupName \ Choose Correct Subscription ID \ workspaceName

“table”: “AzureDiagnostics”,
“filters”: [
{
“column”: “TimeGenerated”,
“operator”: “>”,
“value”: “2019-01-29T19:00:00.000”
}
]

Click Run 

2. Powershell
Install-Module -Name Az.Accounts

[pastacode lang=”powershell” manual=”Connect-AzAccount%0A%0A%24subscriptionId%20%3D%20%22xxxxxxxxxxx%22%0A%23resourcegroup%0A%24rg%20%3D%20%22defaultresourcegroup-eau%22%0A%23workspace%0A%24ws%20%3D%20%22DefaultWorkspace-8402228f-822d-47aa-8552-4133449afe5d-EAU%22%0A%0A%24token%20%3D%20Get-AzAccessToken%20-TenantId%20%24tenantId%20-ErrorAction%20Stop%0A%0A%23POST%20https%3A%2F%2Fmanagement.azure.com%2Fsubscriptions%2F%24subscriptionId%2FresourceGroups%2F%24rg%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2F%24ws%2Fpurge%3Fapi-version%3D2020-08-01%20’Content-%0A%24URI%20%3D%20%22https%3A%2F%2Fmanagement.azure.com%2Fsubscriptions%2F%24%7BsubscriptionId%7D%2FresourceGroups%2F%24%7Brg%7D%2Fproviders%2F%20Microsoft.OperationalInsights%2Fworkspaces%2F%24%7Bws%7D%2Fpurge%3Fapi-version%3D2015-03-20%22%0A%0A%23%20Build%20the%20authorization%20header%20JSON%20object%0A%24authHeader%20%3D%20%40%7B%0A’Content-Type’%3D’application%2Fjson’%0A’Authorization’%3D’Bearer%20%24(%24token.token)’%0A%7D%0A%0A%0A%24body%20%3D%20%40%22%0A%7B%0A%22table%22%3A%20%22AzureDiagnostics%22%2C%0A%22filters%22%3A%20%5B%0A%7B%0A%22column%22%3A%20%22TimeGenerated%22%2C%0A%22operator%22%3A%20%22%3E%22%2C%0A%22value%22%3A%20%222019-01-29T19%3A00%3A00.000%22%0A%7D%0A%5D%0A%7D%0A%22%40%0A%0A%0A%0A%0A%0A%23%20Invoke%20the%20REST%20API%20to%20purge%20the%20data%0A%24purgeID%3DInvoke-RestMethod%20-Uri%20%24URI%20-Method%20POST%20-Headers%20%24authHeader%20-Body%20%24body%0A%23%20Write%20the%20purge%20ID%0AWrite-Host%20%24purgeID.operationId%20-ForegroundColor%20Green%0A%23%23%23%23%20END%20PURGE%20DATA%20%23%23%23%23″ message=”” highlight=”” provider=”manual”/]