capabilities.work

Audit and Clean Up a Saved Search

A 3-step recipe with Azure Log Analytics. We can help you get access.

Recipe · 3 steps

Audit and Clean Up a Saved Search

with Azure Log Analytics

List and inspect a saved search, then conditionally delete it.

  1. List every saved search on the workspace to provide an audit inventory before inspecting the target search.
  2. Read the target saved search to inspect its category and decide whether it should be retired.
  3. Delete the saved search because its category marks it for retirement.
What you'll need to have ready
  • subscriptionId: The ID of the target Azure subscription.
  • resourceGroupName: The resource group that contains the workspace.
  • workspaceName: The management name of the Log Analytics workspace.
  • savedSearchId: The ID of the saved search to audit.
  • retireCategory: The category that marks a saved search for deletion (e.g. Retired).
  • managementApiVersion: The management API version to use.
For your developer

Arazzo workflow azure-log-analytics:audit-and-cleanup-saved-search, 3 operations: listSavedSearches → getSavedSearch → deleteSavedSearch. Specs on APIs.io.

More recipes with Azure Log Analytics

Create Workspace and Baseline Custom TableCross-Workspace QueryDiscover and Query WorkspaceIngest Logs and VerifyBrowse Saved Searches and Run OneInspect Table Schema then QueryValidate then Save a KQL QueryProvision Custom Table then Ingest and VerifyQuery Workspace by Name (GET)Resolve Workspace by Resource Group and Run KQL