Functions editing in Sentinel/Log Analytics doesn't work anymore

Question

When I select "load code to editor" to edit a workspace function in Sentinel/LogAnalytics, the code isn't loaded in a new dedicated tab, but in the current one and treated as brand new code, that I can only save as a new function.

This way I can't modify any existing workspace function, but only create new ones.

I've been observing this behavior since last Monday (July 27th)

Answer 1

Hi @Konstantinos Lianos ,

Thank you for your reply.

Following your suggestion, I also tried using a different browser, but the issue persists.

Furthermore, this morning I encountered the same issue on another Azure subscription, where the “load to editor” command had been working perfectly just an hour earlier.

I’ll try using the CLI, as you suggested, and let you know how it goes.

Answer 2

Hi @Daniele Leopizzi

This is not the expected behaviour. When Load function code is selected for an existing workspace function, the function name should appear in the editor tab and the Save option should allow the existing function to be updated. Save as function is intended for creating a new function

First, please confirm that your account has the Log Analytics Contributor role, or the Microsoft.OperationalInsights/workspaces/savedSearches/write permission.

If the permissions are correct and the same issue occurs in another browser or private session, this is likely a portal UI regression. As a temporary workaround, the existing function can be updated through Azure CLI:

az monitor log-analytics workspace saved-search update \

--resource-group "<resource-group>" \

--workspace-name "<workspace-name>" \

--name "<saved-search-resource-name>" \

--saved-query "<updated-KQL-query>"