az monitor log-analytics workspace table search-job

Manage tables for log analytics workspace search results table.

Commands

Name	Description	Type	Status
az monitor log-analytics workspace table search-job cancel	Cancel a log analytics workspace search results table query run.	Core	GA
az monitor log-analytics workspace table search-job create	Create a Log Analytics workspace search results table. The table name needs to end with '_SRCH'.	Core	GA

az monitor log-analytics workspace table search-job cancel

Cancel a log analytics workspace search results table query run.

az monitor log-analytics workspace table search-job cancel [--ids]
                                                           [--name --table-name]
                                                           [--resource-group]
                                                           [--subscription]
                                                           [--workspace-name]

Examples

Cancel a log analytics workspace search results table query run.

az monitor log-analytics workspace table search-job cancel --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable_SRCH

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name --table-name -n

The name of the table.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--workspace-name

The name of the workspace.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az monitor log-analytics workspace table search-job create

Create a Log Analytics workspace search results table. The table name needs to end with '_SRCH'.

az monitor log-analytics workspace table search-job create --end-search-time
                                                           --name
                                                           --resource-group
                                                           --search-query
                                                           --start-search-time
                                                           --workspace-name
                                                           [--limit]
                                                           [--no-wait]
                                                           [--retention-time]
                                                           [--total-retention-time]

Examples

Create a Log Analytics workspace search result table.

az monitor log-analytics workspace table search-job create --resource-group MyResourceGroup --workspace-name MyWorkspace -n MyTable_SRCH --retention-time 45 --search-query "Heartbeat | where SourceSystem != '' | project SourceSystem" --limit 1000 --start-search-time "Sat, 28 Aug 2021 05:29:18 GMT" --end-search-time "Sat, 28 Aug 2021 08:29:18 GMT"

Required Parameters

--end-search-time

Datetime format. Format: date (yyyy-mm-dd) time (hh:mm:ss.xxxxx) timezone (+/-hh:mm).

--name -n

Name of the table. The table name needs to end with _SRCH.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--search-query

Search job query.

--start-search-time

Datetime format. Format: date (yyyy-mm-dd) time (hh:mm:ss.xxxxx) timezone (+/-hh:mm).

--workspace-name

Name of the Log Analytics Workspace.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--limit

Limit the search job to return up to specified number of rows.

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Default value:	False

--retention-time

The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention.

--total-retention-time

The table total retention in days, between 4 and 2556. Setting this property to -1 will default to table retention.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False