Microsoft.OperationalInsights workspaces/savedSearches
Bicep resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.OperationalInsights/workspaces/savedSearches@2020-08-01' = {
name: 'string'
parent: resourceSymbolicName
etag: 'string'
properties: {
category: 'string'
displayName: 'string'
functionAlias: 'string'
functionParameters: 'string'
query: 'string'
tags: [
{
name: 'string'
value: 'string'
}
]
version: int
}
}
Property values
workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| name | The resource name See how to set names and types for child resources in Bicep. |
string (required) |
| parent | In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource. |
Symbolic name for resource of type: workspaces |
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | object |
| version | The version number of the query language. The current version is 2 and is the default. | int |
Quickstart templates
The following quickstart templates deploy this resource type.
| Template | Description |
|---|---|
OMS - Azure VM Inventory Solution |
Enables Azure VM Inventory Solution in OMS. Solution collects Azure VM inventory along with disks, networking components, NSG rules and extensions into OMS workspace. |
| OMS Kemp Application Delivery |
Kemp Application Delivery solution for OMS |
| OMS SCOM ACS Solution |
Adds the SCOM ACS custom Solution into an OMS Workspace |
ARM template resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following JSON to your template.
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"apiVersion": "2020-08-01",
"name": "string",
"etag": "string",
"properties": {
"category": "string",
"displayName": "string",
"functionAlias": "string",
"functionParameters": "string",
"query": "string",
"tags": [
{
"name": "string",
"value": "string"
}
],
"version": "int"
}
}
Property values
workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| type | The resource type | 'Microsoft.OperationalInsights/workspaces/savedSearches' |
| apiVersion | The resource api version | '2020-08-01' |
| name | The resource name See how to set names and types for child resources in JSON ARM templates. |
string (required) |
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | object |
| version | The version number of the query language. The current version is 2 and is the default. | int |
Quickstart templates
The following quickstart templates deploy this resource type.
| Template | Description |
|---|---|
| OMS - Azure VM Inventory Solution |
Enables Azure VM Inventory Solution in OMS. Solution collects Azure VM inventory along with disks, networking components, NSG rules and extensions into OMS workspace. |
| OMS Kemp Application Delivery |
Kemp Application Delivery solution for OMS |
| OMS SCOM ACS Solution |
Adds the SCOM ACS custom Solution into an OMS Workspace |
Terraform (AzAPI provider) resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.OperationalInsights/workspaces/savedSearches@2020-08-01"
name = "string"
parent_id = "string"
body = jsonencode({
properties = {
category = "string"
displayName = "string"
functionAlias = "string"
functionParameters = "string"
query = "string"
tags = [
{
name = "string"
value = "string"
}
]
version = int
}
etag = "string"
})
}
Property values
workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| type | The resource type | "Microsoft.OperationalInsights/workspaces/savedSearches@2020-08-01" |
| name | The resource name | string (required) |
| parent_id | The ID of the resource that is the parent for this resource. | ID for resource of type: workspaces |
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | object |
| version | The version number of the query language. The current version is 2 and is the default. | int |