saved_searches

Creates, updates, deletes, gets or lists a saved_searches resource.

Overview

Name	saved_searches
Type	Resource
Id	azure.log_analytics.saved_searches

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
category	string	The category of the saved search. This helps the user to find a saved search faster. Required.
displayName	string	Saved search display name. Required.
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag.
functionAlias	string	The function alias if query serves as a function.
functionParameters	string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions _.
query	string	The query expression for the saved search. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	array	The tags attached to the saved search.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	integer	The version number of the query language. The current version is 2 and is the default.

list_by_workspace

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
category	string	The category of the saved search. This helps the user to find a saved search faster. Required.
displayName	string	Saved search display name. Required.
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag.
functionAlias	string	The function alias if query serves as a function.
functionParameters	string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions _.
query	string	The query expression for the saved search. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	array	The tags attached to the saved search.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	integer	The version number of the query language. The current version is 2 and is the default.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, saved_search_id, subscription_id		Gets the specified saved search for a given workspace.
list_by_workspace	select	resource_group_name, workspace_name, subscription_id		Gets the saved searches for a given Log Analytics Workspace.
create_or_update	insert	resource_group_name, workspace_name, saved_search_id, subscription_id, properties		Creates or updates a saved search for a given workspace.
create_or_update	replace	resource_group_name, workspace_name, saved_search_id, subscription_id, properties		Creates or updates a saved search for a given workspace.
delete	delete	resource_group_name, workspace_name, saved_search_id, subscription_id		Deletes the specified saved search in a given workspace.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
saved_search_id	string	The id of the saved search. Required.
subscription_id	string
workspace_name	string	The name of the workspace. Required.

SELECT examples

get

Gets the specified saved search for a given workspace.

SELECT
id,
name,
category,
displayName,
etag,
functionAlias,
functionParameters,
query,
systemData,
tags,
type,
version
FROM azure.log_analytics.saved_searches
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND saved_search_id = '{{ saved_search_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_workspace

Gets the saved searches for a given Log Analytics Workspace.

SELECT
id,
name,
category,
displayName,
etag,
functionAlias,
functionParameters,
query,
systemData,
tags,
type,
version
FROM azure.log_analytics.saved_searches
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates a saved search for a given workspace.

INSERT INTO azure.log_analytics.saved_searches (
properties,
etag,
resource_group_name,
workspace_name,
saved_search_id,
subscription_id
)
SELECT 
'{{ properties }}' /* required */,
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ saved_search_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: saved_searches
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the saved_searches resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the saved_searches resource.
  - name: saved_search_id
    value: "{{ saved_search_id }}"
    description: Required parameter for the saved_searches resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the saved_searches resource.
  - name: properties
    description: |
      The properties of the saved search. Required.
    value:
      category: "{{ category }}"
      displayName: "{{ displayName }}"
      query: "{{ query }}"
      functionAlias: "{{ functionAlias }}"
      functionParameters: "{{ functionParameters }}"
      version: {{ version }}
      tags:
        - name: "{{ name }}"
          value: "{{ value }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag.

REPLACE examples

create_or_update

Creates or updates a saved search for a given workspace.

REPLACE azure.log_analytics.saved_searches
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND saved_search_id = '{{ saved_search_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
AND properties = '{{ properties }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Deletes the specified saved search in a given workspace.

DELETE FROM azure.log_analytics.saved_searches
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND saved_search_id = '{{ saved_search_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;