Saved Searches - Get

Reference

Service:: Log Analytics

API Version:: 2023-09-01

Gets the specified saved search for a given workspace.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches/{savedSearchId}?api-version=2023-09-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
savedSearchId	path	True	string	The id of the saved search.
subscriptionId	path	True	string	The ID of the target subscription.
workspaceName	path	True	string	The name of the workspace. Regex pattern: `^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$`
api-version	query	True	string	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	SavedSearch	OK response definition.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

SavedSearchesGet

Sample request

HTTP

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches/00000000-0000-0000-0000-00000000000?api-version=2023-09-01

Sample response

Status code:: 200

{
  "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
  "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
  "properties": {
    "category": " Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "* | measure Count() by Computer | take a",
    "version": 1
  }
}

Definitions

Name	Description
SavedSearch	Value object for saved search results.
Tag	A tag of a saved search.

SavedSearch

Value object for saved search results.

Name	Type	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	The name of the resource
properties.category	string	The category of the saved search. This helps the user to find a saved search faster.
properties.displayName	string	Saved search display name.
properties.functionAlias	string	The function alias if query serves as a function.
properties.functionParameters	string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.
properties.query	string	The query expression for the saved search.
properties.tags	Tag[]	The tags attached to the saved search.
properties.version	integer	The version number of the query language. The current version is 2 and is the default.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

Tag

A tag of a saved search.

Name	Type	Description
name	string	The tag name.
value	string	The tag value.

Share via