capabilities.work

Browse Saved Searches and Run One

A 3-step recipe with Azure Log Analytics. We can help you get access.

Recipe · 3 steps

Browse Saved Searches and Run One

with Azure Log Analytics

Enumerate saved searches, fetch one's stored KQL, and execute it.

  1. List every saved search on the workspace so the target search can be confirmed before fetching its full definition.
  2. Read the chosen saved search to obtain its stored KQL query and category.
  3. Execute the saved search's stored KQL query against the workspace and return the tabular results.
What you'll need to have ready
  • subscriptionId: The ID of the target Azure subscription.
  • resourceGroupName: The resource group that contains the workspace.
  • workspaceName: The management name of the Log Analytics workspace.
  • savedSearchId: The ID of the saved search to fetch and run.
  • workspaceId: The customer (workspace) GUID used by the query endpoint.
  • timespan: Optional ISO 8601 duration limiting the query window (e.g. P1D).
  • managementApiVersion: The management API version to use.
For your developer

Arazzo workflow azure-log-analytics:list-saved-searches-and-run, 3 operations: listSavedSearches → getSavedSearch → postQuery. Specs on APIs.io.

More recipes with Azure Log Analytics

Audit and Clean Up a Saved SearchCreate Workspace and Baseline Custom TableCross-Workspace QueryDiscover and Query WorkspaceIngest Logs and VerifyInspect Table Schema then QueryValidate then Save a KQL QueryProvision Custom Table then Ingest and VerifyQuery Workspace by Name (GET)Resolve Workspace by Resource Group and Run KQL