Saved Searches - List By Workspace

Service:

Log Analytics

API Version:

2025-02-01

Gets the saved searches for a given Log Analytics Workspace

GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches?api-version=2025-02-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	SavedSearchesListResult	Returns the list of saved searches for the given Log Analytics Workspace.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

SavedSearchesList

Sample request

HTTP

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches?api-version=2025-02-01

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.OperationalInsights.Models;
using Azure.ResourceManager.OperationalInsights;

// Generated from example definition: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2025-02-01/examples/SavedSearchesListByWorkspace.json
// this example is just showing the usage of "SavedSearches_ListByWorkspace" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceResource created on azure
// for more information of creating OperationalInsightsWorkspaceResource, please refer to the document of OperationalInsightsWorkspaceResource
string subscriptionId = "00000000-0000-0000-0000-00000000000";
string resourceGroupName = "TestRG";
string workspaceName = "TestWS";
ResourceIdentifier operationalInsightsWorkspaceResourceId = OperationalInsightsWorkspaceResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceResource operationalInsightsWorkspace = client.GetOperationalInsightsWorkspaceResource(operationalInsightsWorkspaceResourceId);

// get the collection of this OperationalInsightsSavedSearchResource
OperationalInsightsSavedSearchCollection collection = operationalInsightsWorkspace.GetOperationalInsightsSavedSearches();

// invoke the operation and iterate over the result
await foreach (OperationalInsightsSavedSearchResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    OperationalInsightsSavedSearchData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine("Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

[
  {
    "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
    "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
    "properties": {
      "Category": " Saved Search Test Category",
      "DisplayName": "Create or Update Saved Search Test",
      "Query": "* | measure Count() by Computer",
      "Tags": [
        {
          "Name": "Group",
          "Value": "Computer"
        }
      ],
      "Version": 1
    }
  }
]

Definitions

Name	Description
SavedSearch	Value object for saved search results.
SavedSearchesListResult	The saved search list operation response.
Tag	A tag of a saved search.

SavedSearch

Object

Value object for saved search results.

Name	Type	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	The name of the resource
properties.category	string	The category of the saved search. This helps the user to find a saved search faster.
properties.displayName	string	Saved search display name.
properties.functionAlias	string	The function alias if query serves as a function.
properties.functionParameters	string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.
properties.query	string	The query expression for the saved search.
properties.tags	Tag[]	The tags attached to the saved search.
properties.version	integer (int64)	The version number of the query language. The current version is 2 and is the default.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

SavedSearchesListResult

Object

The saved search list operation response.

Name	Type	Description
value	SavedSearch[]	The array of result values.

Tag

Object

A tag of a saved search.

Name	Type	Description
name	string	The tag name.
value	string	The tag value.