Summary rules - Limit on total aggregated size
Folks,
I'm trying to use summary rules to aggregate firewall logs. There's a hard size limit from MS per result of 100 MB which I think is not up to the mark for firewall logs. While summarizing I'm creating two sets and grouping by 7 other fields (I need for alarms). The summary rule works 60% of the time, 40% of the time it fails because of a spike in logs that leads to the size exceeding 100 MB. I can't think of a way to workaround this. Anybody figured it out yet?
Probably can create a limit in kql to check for size and ignore anything above 100 MB but I can't think of a way I can do this in kql.