Saved Searches - List By Workspace

Gets the saved searches for a given Log Analytics Workspace

GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches?api-version=2020-08-01

URI Parameters

Name In Required Type Description
resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

The ID of the target subscription.

workspaceName
path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True

string

The API version to use for this operation.

Responses

Name Type Description
200 OK

SavedSearchesListResult

Returns the list of saved searches for the given Log Analytics Workspace.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

SavedSearchesList

Sample Request

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches?api-version=2020-08-01

Sample Response

[
  {
    "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
    "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
    "properties": {
      "Category": " Saved Search Test Category",
      "DisplayName": "Create or Update Saved Search Test",
      "Query": "* | measure Count() by Computer",
      "Tags": [
        {
          "Name": "Group",
          "Value": "Computer"
        }
      ],
      "Version": 1
    }
  }
]

Definitions

Name Description
SavedSearch

Value object for saved search results.

SavedSearchesListResult

The saved search list operation response.

Tag

A tag of a saved search.

SavedSearch

Value object for saved search results.

Name Type Description
etag

string

The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag

id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

name

string

The name of the resource

properties.category

string

The category of the saved search. This helps the user to find a saved search faster.

properties.displayName

string

Saved search display name.

properties.functionAlias

string

The function alias if query serves as a function.

properties.functionParameters

string

The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.

properties.query

string

The query expression for the saved search.

properties.tags

Tag[]

The tags attached to the saved search.

properties.version

integer

The version number of the query language. The current version is 2 and is the default.

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

SavedSearchesListResult

The saved search list operation response.

Name Type Description
value

SavedSearch[]

The array of result values.

Tag

A tag of a saved search.

Name Type Description
name

string

The tag name.

value

string

The tag value.