I want to store some events longer than 30 days. Especially events where an error occurred and events where a player probably cheated.
I use this code for CloudScript errors:
['events.all'] | where Timestamp > ago(30d) | where FullName_Name == 'player_executed_cloudscript' | extend d=parse_json(EventData) | extend ExecutionResult = d.CloudScriptExecutionResult.Error | where isnotempty(ExecutionResult)
What can I do if I want to display all failed events in Data Explorer (advanced) and not only failed CloudScript events? With my code, it only displays the CloudScript events.
In addition, I want to store failed events as long as I need them. I want to store the events because I need them for further investigations.
How can I store events if I need them longer than 30 days? Is it necessary to export them somehow?