saved_searches

Creates, updates, deletes, gets or lists a saved_searches resource.

Overview

Name	saved_searches
Type	Resource
Id	azure.log_analytics.saved_searches

Fields

vw_saved_searches

Name	Datatype	Description
category	text	field from the properties object
display_name	text	field from the properties object
etag	text	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
function_alias	text	field from the properties object
function_parameters	text	field from the properties object
query	text	field from the properties object
resourceGroupName	text	field from the properties object
savedSearchId	text	field from the properties object
subscriptionId	text	field from the properties object
tags	text	field from the properties object
version	text	field from the properties object
workspaceName	text	field from the properties object

saved_searches

Name	Datatype	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
properties	object	Value object for saved search results.

Methods

Name	Accessible by	Required Params	Description
get	SELECT	resourceGroupName, savedSearchId, subscriptionId, workspaceName	Gets the specified saved search for a given workspace.
list_by_workspace	SELECT	resourceGroupName, subscriptionId, workspaceName	Gets the saved searches for a given Log Analytics Workspace
create_or_update	INSERT	resourceGroupName, savedSearchId, subscriptionId, workspaceName, data__properties	Creates or updates a saved search for a given workspace.
delete	DELETE	resourceGroupName, savedSearchId, subscriptionId, workspaceName	Deletes the specified saved search in a given workspace.

SELECT examples

Gets the saved searches for a given Log Analytics Workspace

vw_saved_searches

SELECT
category,
display_name,
etag,
function_alias,
function_parameters,
query,
resourceGroupName,
savedSearchId,
subscriptionId,
tags,
version,
workspaceName
FROM azure.log_analytics.vw_saved_searches
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

saved_searches

SELECT
etag,
properties
FROM azure.log_analytics.saved_searches
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

INSERT example

Use the following StackQL query and manifest file to create a new saved_searches resource.

All Properties

/*+ create */
INSERT INTO azure.log_analytics.saved_searches (
resourceGroupName,
savedSearchId,
subscriptionId,
workspaceName,
data__properties,
etag,
properties
)
SELECT 
'{{ resourceGroupName }}',
'{{ savedSearchId }}',
'{{ subscriptionId }}',
'{{ workspaceName }}',
'{{ data__properties }}',
'{{ etag }}',
'{{ properties }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: etag
      value: string
    - name: properties
      value:
        - name: category
          value: string
        - name: displayName
          value: string
        - name: query
          value: string
        - name: functionAlias
          value: string
        - name: functionParameters
          value: string
        - name: version
          value: integer
        - name: tags
          value:
            - - name: name
                value: string
              - name: value
                value: string

DELETE example

Deletes the specified saved_searches resource.

/*+ delete */
DELETE FROM azure.log_analytics.saved_searches
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND savedSearchId = '{{ savedSearchId }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';