Saved Searches - Create Or Update

Creates or updates a saved search for a given workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches/{savedSearchId}?api-version=2020-08-01

URI Parameters

Name In Required Type Description
resourceGroupName
path True
  • string

The name of the resource group. The name is case insensitive.

Regex pattern: ^[-\w\._\(\)]+$

savedSearchId
path True
  • string

The id of the saved search.

subscriptionId
path True
  • string

The ID of the target subscription.

workspaceName
path True
  • string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True
  • string

The API version to use for this operation.

Request Body

Name Required Type Description
properties.category True
  • string

The category of the saved search. This helps the user to find a saved search faster.

properties.displayName True
  • string

Saved search display name.

properties.query True
  • string

The query expression for the saved search.

etag
  • string

The ETag of the saved search.

properties.functionAlias
  • string

The function alias if query serves as a function.

properties.functionParameters
  • string

The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.

properties.tags

The tags attached to the saved search.

properties.version
  • integer

The version number of the query language. The current version is 2 and is the default.

Responses

Name Type Description
200 OK

OK response definition.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

SavedSearchCreateOrUpdate

Sample Request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches/00000000-0000-0000-0000-00000000000?api-version=2020-08-01
{
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "version": 2,
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

Sample Response

{
  "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
  "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "version": 2
  }
}

Definitions

SavedSearch

Value object for saved search results.

Tag

A tag of a saved search.

SavedSearch

Value object for saved search results.

Name Type Description
etag
  • string

The ETag of the saved search.

id
  • string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

name
  • string

The name of the resource

properties.category
  • string

The category of the saved search. This helps the user to find a saved search faster.

properties.displayName
  • string

Saved search display name.

properties.functionAlias
  • string

The function alias if query serves as a function.

properties.functionParameters
  • string

The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.

properties.query
  • string

The query expression for the saved search.

properties.tags

The tags attached to the saved search.

properties.version
  • integer

The version number of the query language. The current version is 2 and is the default.

type
  • string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

Tag

A tag of a saved search.

Name Type Description
name
  • string

The tag name.

value
  • string

The tag value.