saved_searches

Creates, updates, deletes, gets or lists a saved_searches resource.

Overview

Name	saved_searches
Type	Resource
Id	azure.log_analytics.saved_searches

Fields

The following fields are returned by SELECT queries:

get

OK response definition.

Name	Datatype	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
properties	object	The properties of the saved search.

list_by_workspace

Returns the list of saved searches for the given Log Analytics Workspace.

Name	Datatype	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
properties	object	The properties of the saved search.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	subscriptionId, resourceGroupName, workspaceName, savedSearchId		Gets the specified saved search for a given workspace.
list_by_workspace	select	resourceGroupName, workspaceName, subscriptionId		Gets the saved searches for a given Log Analytics Workspace
create_or_update	insert	subscriptionId, resourceGroupName, workspaceName, savedSearchId, data__properties		Creates or updates a saved search for a given workspace.
delete	delete	subscriptionId, resourceGroupName, workspaceName, savedSearchId		Deletes the specified saved search in a given workspace.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resourceGroupName	string	The name of the resource group. The name is case insensitive.
savedSearchId	string	The id of the saved search.
subscriptionId	string	The ID of the target subscription.
workspaceName	string	The name of the workspace.

SELECT examples

get

Gets the specified saved search for a given workspace.

SELECT
etag,
properties
FROM azure.log_analytics.saved_searches
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND savedSearchId = '{{ savedSearchId }}' -- required
;

list_by_workspace

Gets the saved searches for a given Log Analytics Workspace

SELECT
etag,
properties
FROM azure.log_analytics.saved_searches
WHERE resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND subscriptionId = '{{ subscriptionId }}' -- required
;

INSERT examples

create_or_update

Creates or updates a saved search for a given workspace.

INSERT INTO azure.log_analytics.saved_searches (
data__etag,
data__properties,
subscriptionId,
resourceGroupName,
workspaceName,
savedSearchId
)
SELECT 
'{{ etag }}',
'{{ properties }}' /* required */,
'{{ subscriptionId }}',
'{{ resourceGroupName }}',
'{{ workspaceName }}',
'{{ savedSearchId }}'
RETURNING
etag,
properties
;

Manifest

# Description fields are for documentation purposes
- name: saved_searches
  props:
    - name: subscriptionId
      value: string
      description: Required parameter for the saved_searches resource.
    - name: resourceGroupName
      value: string
      description: Required parameter for the saved_searches resource.
    - name: workspaceName
      value: string
      description: Required parameter for the saved_searches resource.
    - name: savedSearchId
      value: string
      description: Required parameter for the saved_searches resource.
    - name: etag
      value: string
      description: |
        The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
    - name: properties
      value: object
      description: |
        The properties of the saved search.

DELETE examples

delete

Deletes the specified saved search in a given workspace.

DELETE FROM azure.log_analytics.saved_searches
WHERE subscriptionId = '{{ subscriptionId }}' --required
AND resourceGroupName = '{{ resourceGroupName }}' --required
AND workspaceName = '{{ workspaceName }}' --required
AND savedSearchId = '{{ savedSearchId }}' --required
;