Invoke-AzOperationalInsightsQuery
Returns search results based on the specified parameters.
Invoke-AzOperationalInsightsQuery
-WorkspaceId <String>
-Query <String>
[-Timespan <TimeSpan>]
[-Wait <Int32>]
[-IncludeRender]
[-IncludeStatistics]
[-AsJob]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>]
Invoke-AzOperationalInsightsQuery
-Workspace <PSWorkspace>
-Query <String>
[-Timespan <TimeSpan>]
[-Wait <Int32>]
[-IncludeRender]
[-IncludeStatistics]
[-AsJob]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>]
The Invoke-AzOperationalInsightsQuery cmdlet returns the search results based on the specified parameters. You can access the status of the search in the Metadata property of the returned object. If the status is Pending, then the search has not completed, and the results will be from the archive. You can retrieve the results of the search from the Value property of the returned object. Please check detail of general query limits here: https://learn.microsoft.com/azure/azure-monitor/service-limits#log-queries-and-language.
Note: try setting -Wait
to a larger value if you experience the error 'The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing'.
$query = "union * | take 10"
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query $query
$queryResults.Results
Once invoked, $queryResults.Results will contain all of the resulting rows from your query.
$query = "union * | take 10"
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query $query
$resultsArray = [System.Linq.Enumerable]::ToArray($queryResults.Results)
Some queries can result in very large data sets being returned. Because of this, the default behavior of the cmdlet is to return an IEnumerable to reduce memory costs. If you'd prefer to have an array of results, you can use the LINQ Enumerable.ToArray() extension method to convert the IEnumerable to an array.
$query = "union * | take 10"
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query $query -Timespan (New-TimeSpan -Hours 24)
$queryResults.Results
The results from this query will be limited to the past 24 hours.
$query = "union * | take 10"
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query $query -IncludeRender -IncludeStatistics
$queryResults.Results
$queryResults.Render
$queryResults.Statistics
Run cmdlet in the background
Type: | SwitchParameter |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
The credentials, account, tenant, and subscription used for communication with azure.
Type: | IAzureContextContainer |
Aliases: | AzContext, AzureRmContext, AzureCredential |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
If specified, rendering information for metric queries will be included in the response.
Type: | SwitchParameter |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
If specified, query statistics will be included in the response.
Type: | SwitchParameter |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
The query to execute.
Type: | String |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
The timespan to bound the query by.
Type: | Nullable<T>[TimeSpan] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
Puts an upper bound on the amount of time the server will spend processing the query. See: https://learn.microsoft.com/azure/azure-monitor/logs/api/timeouts
Type: | Nullable<T>[Int32] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
The workspace
Type: | PSWorkspace |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
The workspace ID.
Type: | String |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
Azure PowerShell feedback
Azure PowerShell is an open source project. Select a link to provide feedback: