Share via

Invoke-AzOperationalInsightsQuery Search

  • Article

Question

Wednesday, April 15, 2020 10:14 PM

Script 

$WorkspaceID  = "your own ....";

$query = @"

union * 
| take 10

"@

Write-Host $query 

$param = @{
     WorkspaceId  = $WorkspaceID  
     Query  = $query
}

$queryResults = Invoke-AzOperationalInsightsQuery @param
$queryResults.Results | Export-Csv -Path "logs.txt"

That works 

But if you try  some more complex  query .... don't work 

Questions

1.  union * | take 10

      The result from  powershell   is not  the same in the azure portal Why  they are differents?

2.

union *

| where tostring(customDimensions['InterfaceTransactionId']) == 'e9cbfd96-7ca9-4ab7-bfb6-a57ad8f60b2f'

| top 101 by timestamp asc

That query is ok in the portal  not in  the powershell 

Powershell Error  

Invoke-AzOperationalInsightsQuery : Operation returned an invalid status code 'BadRequest'
At C:\work\ps\conn.ps1:31 char:17

  • $queryResults = Invoke-AzOperationalInsightsQuery @param
    +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : CloseError: (:) [Invoke-AzOperationalInsightsQuery], ErrorResponseException
        + FullyQualifiedErrorId : Microsoft.Azure.Commands.OperationalInsights.Query.InvokeOperationalInsightsQuery

 

All replies (1)

Wednesday, April 22, 2020 5:07 AM

Hello, Reinerra!

To answer your first question, "Why are the results different in PowerShell and the Portal?", I believe what you are seeing is the random nature of take.  Take 10 returns 10 results in no specific order which does not always produce identical results:
/en-us/azure/azure-monitor/log-query/get-started-queries#table-based-queries

To answer your second question, "Why does this query work in the Portal but not PowerShell?", your query worked for me in PowerShell (complete with a newly generated "logs.txt") which leads me to believe that you are missing an update:
/en-us/powershell/azure/?view=azps-3.8.0

If you still are running into errors after a full update, please let us know so we can troubleshoot this further.