Saved Searches - Create Or Update

Service:

Log Analytics

API Version:

2020-08-01

Hiermee wordt een opgeslagen zoekopdracht voor een bepaalde werkruimte gemaakt of bijgewerkt.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches/{savedSearchId}?api-version=2020-08-01

URI-parameters

Name	In	Vereist	Type	Description
resourceGroupName	path	True	string	De naam van de resourcegroep. De naam is niet hoofdlettergevoelig.
savedSearchId	path	True	string	De id van de opgeslagen zoekopdracht.
subscriptionId	path	True	string	De id van het doelabonnement.
workspaceName	path	True	string	De naam van de werkruimte. Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version	query	True	string	De API-versie die voor deze bewerking moet worden gebruikt.

Aanvraagbody

Name	Vereist	Type	Description
properties.category	True	string	De categorie van de opgeslagen zoekopdracht. Hierdoor kan de gebruiker een opgeslagen zoekopdracht sneller vinden.
properties.displayName	True	string	Weergavenaam van zoekactie opgeslagen.
properties.query	True	string	De query-expressie voor de opgeslagen zoekopdracht.
etag		string	De ETag van de opgeslagen zoekopdracht. Als u een bestaande opgeslagen zoekopdracht wilt overschrijven, gebruikt u *of geeft u de huidige Etag op
properties.functionAlias		string	De functiealias als query fungeert als een functie.
properties.functionParameters		string	De optionele functieparameters als de query als functie fungeert. De waarde moet de volgende indeling hebben: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. Raadpleeg https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functionsvoor meer voorbeelden en de juiste syntaxis.
properties.tags		Tag[]	De tags die zijn gekoppeld aan de opgeslagen zoekopdracht.
properties.version		integer	Het versienummer van de querytaal. De huidige versie is 2 en is de standaardversie.

Antwoorden

Name	Type	Description
200 OK	SavedSearch	Definitie van OK-antwoord.

Beveiliging

azure_auth

Azure Active Directory OAuth2-stroom

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	Uw gebruikersaccount imiteren

Voorbeelden

SavedSearchCreateOrUpdate

Sample Request

HTTP

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches/00000000-0000-0000-0000-00000000000?api-version=2020-08-01

{
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "version": 2,
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

Java

import com.azure.resourcemanager.loganalytics.models.Tag;
import java.util.Arrays;

/** Samples for SavedSearches CreateOrUpdate. */
public final class Main {
    /*
     * x-ms-original-file: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2020-08-01/examples/WorkspacesSavedSearchesCreateOrUpdate.json
     */
    /**
     * Sample code: SavedSearchCreateOrUpdate.
     *
     * @param manager Entry point to LogAnalyticsManager.
     */
    public static void savedSearchCreateOrUpdate(com.azure.resourcemanager.loganalytics.LogAnalyticsManager manager) {
        manager
            .savedSearches()
            .define("00000000-0000-0000-0000-00000000000")
            .withExistingWorkspace("TestRG", "TestWS")
            .withCategory("Saved Search Test Category")
            .withDisplayName("Create or Update Saved Search Test")
            .withQuery("Heartbeat | summarize Count() by Computer | take a")
            .withTags(Arrays.asList(new Tag().withName("Group").withValue("Computer")))
            .withFunctionAlias("heartbeat_func")
            .withFunctionParameters("a:int=1")
            .withVersion(2L)
            .create();
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from azure.identity import DefaultAzureCredential
from azure.mgmt.loganalytics import LogAnalyticsManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-loganalytics
# USAGE
    python workspaces_saved_searches_create_or_update.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = LogAnalyticsManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="00000000-0000-0000-0000-00000000000",
    )

    response = client.saved_searches.create_or_update(
        resource_group_name="TestRG",
        workspace_name="TestWS",
        saved_search_id="00000000-0000-0000-0000-00000000000",
        parameters={
            "properties": {
                "category": "Saved Search Test Category",
                "displayName": "Create or Update Saved Search Test",
                "functionAlias": "heartbeat_func",
                "functionParameters": "a:int=1",
                "query": "Heartbeat | summarize Count() by Computer | take a",
                "tags": [{"name": "Group", "value": "Computer"}],
                "version": 2,
            }
        },
    )
    print(response)


# x-ms-original-file: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2020-08-01/examples/WorkspacesSavedSearchesCreateOrUpdate.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armoperationalinsights_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/operationalinsights/armoperationalinsights"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/c767823fdfd9d5e96bad245e3ea4d14d94a716bb/specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2020-08-01/examples/WorkspacesSavedSearchesCreateOrUpdate.json
func ExampleSavedSearchesClient_CreateOrUpdate() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armoperationalinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewSavedSearchesClient().CreateOrUpdate(ctx, "TestRG", "TestWS", "00000000-0000-0000-0000-00000000000", armoperationalinsights.SavedSearch{
		Properties: &armoperationalinsights.SavedSearchProperties{
			Category:           to.Ptr("Saved Search Test Category"),
			DisplayName:        to.Ptr("Create or Update Saved Search Test"),
			FunctionAlias:      to.Ptr("heartbeat_func"),
			FunctionParameters: to.Ptr("a:int=1"),
			Query:              to.Ptr("Heartbeat | summarize Count() by Computer | take a"),
			Tags: []*armoperationalinsights.Tag{
				{
					Name:  to.Ptr("Group"),
					Value: to.Ptr("Computer"),
				}},
			Version: to.Ptr[int64](2),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.SavedSearch = armoperationalinsights.SavedSearch{
	// 	ID: to.Ptr("subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015"),
	// 	Etag: to.Ptr("W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\""),
	// 	Properties: &armoperationalinsights.SavedSearchProperties{
	// 		Category: to.Ptr("Saved Search Test Category"),
	// 		DisplayName: to.Ptr("Create or Update Saved Search Test"),
	// 		FunctionAlias: to.Ptr("heartbeat_func"),
	// 		FunctionParameters: to.Ptr("a:int=1"),
	// 		Query: to.Ptr("Heartbeat | summarize Count() by Computer | take a"),
	// 		Version: to.Ptr[int64](2),
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { OperationalInsightsManagementClient } = require("@azure/arm-operationalinsights");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Creates or updates a saved search for a given workspace.
 *
 * @summary Creates or updates a saved search for a given workspace.
 * x-ms-original-file: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2020-08-01/examples/WorkspacesSavedSearchesCreateOrUpdate.json
 */
async function savedSearchCreateOrUpdate() {
  const subscriptionId =
    process.env["OPERATIONALINSIGHTS_SUBSCRIPTION_ID"] || "00000000-0000-0000-0000-00000000000";
  const resourceGroupName = process.env["OPERATIONALINSIGHTS_RESOURCE_GROUP"] || "TestRG";
  const workspaceName = "TestWS";
  const savedSearchId = "00000000-0000-0000-0000-00000000000";
  const parameters = {
    category: "Saved Search Test Category",
    displayName: "Create or Update Saved Search Test",
    functionAlias: "heartbeat_func",
    functionParameters: "a:int=1",
    query: "Heartbeat | summarize Count() by Computer | take a",
    tags: [{ name: "Group", value: "Computer" }],
    version: 2,
  };
  const credential = new DefaultAzureCredential();
  const client = new OperationalInsightsManagementClient(credential, subscriptionId);
  const result = await client.savedSearches.createOrUpdate(
    resourceGroupName,
    workspaceName,
    savedSearchId,
    parameters
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.OperationalInsights;
using Azure.ResourceManager.OperationalInsights.Models;

// Generated from example definition: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2020-08-01/examples/WorkspacesSavedSearchesCreateOrUpdate.json
// this example is just showing the usage of "SavedSearches_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsSavedSearchResource created on azure
// for more information of creating OperationalInsightsSavedSearchResource, please refer to the document of OperationalInsightsSavedSearchResource
string subscriptionId = "00000000-0000-0000-0000-00000000000";
string resourceGroupName = "TestRG";
string workspaceName = "TestWS";
string savedSearchId = "00000000-0000-0000-0000-00000000000";
ResourceIdentifier operationalInsightsSavedSearchResourceId = OperationalInsightsSavedSearchResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName, savedSearchId);
OperationalInsightsSavedSearchResource operationalInsightsSavedSearch = client.GetOperationalInsightsSavedSearchResource(operationalInsightsSavedSearchResourceId);

// invoke the operation
OperationalInsightsSavedSearchData data = new OperationalInsightsSavedSearchData("Saved Search Test Category", "Create or Update Saved Search Test", "Heartbeat | summarize Count() by Computer | take a")
{
    FunctionAlias = "heartbeat_func",
    FunctionParameters = "a:int=1",
    Version = 2,
    Tags =
    {
    new OperationalInsightsTag("Group","Computer")
    },
};
ArmOperation<OperationalInsightsSavedSearchResource> lro = await operationalInsightsSavedSearch.UpdateAsync(WaitUntil.Completed, data);
OperationalInsightsSavedSearchResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
OperationalInsightsSavedSearchData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample Response

Status code:

200

{
  "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
  "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "version": 2
  }
}

Definities

Name	Description
SavedSearch	Waardeobject voor opgeslagen zoekresultaten.
Tag	Een tag van een opgeslagen zoekopdracht.

SavedSearch

Waardeobject voor opgeslagen zoekresultaten.

Name	Type	Description
etag	string	De ETag van de opgeslagen zoekopdracht. Als u een bestaande opgeslagen zoekopdracht wilt overschrijven, gebruikt u *of geeft u de huidige Etag op
id	string	Volledig gekwalificeerde resource-id voor de resource. Bijvoorbeeld - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	De naam van de resource
properties.category	string	De categorie van de opgeslagen zoekopdracht. Hierdoor kan de gebruiker een opgeslagen zoekopdracht sneller vinden.
properties.displayName	string	Weergavenaam van zoekactie opgeslagen.
properties.functionAlias	string	De functiealias als query fungeert als een functie.
properties.functionParameters	string	De optionele functieparameters als de query als functie fungeert. De waarde moet de volgende indeling hebben: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. Raadpleeg https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functionsvoor meer voorbeelden en de juiste syntaxis.
properties.query	string	De query-expressie voor de opgeslagen zoekopdracht.
properties.tags	Tag[]	De tags die zijn gekoppeld aan de opgeslagen zoekopdracht.
properties.version	integer	Het versienummer van de querytaal. De huidige versie is 2 en is de standaardversie.
type	string	Het type resource. Bijvoorbeeld 'Microsoft.Compute/virtualMachines' of 'Microsoft.Storage/storageAccounts'

Tag

Een tag van een opgeslagen zoekopdracht.

Name	Type	Description
name	string	De tagnaam.
value	string	De tagwaarde.