Forum Discussion

Brady Evans's avatar
Brady Evans
Copper Contributor
Jan 12, 2018
Solved

Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

I'm trying to use the new PowerShell based API (Invoke-LogAnalyticsQuery - see below) and the return payload only includes the Tables array and not the Results array as documented..  

 

import-module .\LogAnalyticsQuery.psm1

$queryString = 'search * | where Type == "Heartbeat" | take 10'
$workspaceName = "xxxx"
$resourceGroupName = "xxxx"
$subscriptionID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

$response = invoke-loganalyticsquery -WorkspaceName $workspaceName -ResourceGroup $resourceGroupName -Query $queryString -SubscriptionId $subscriptionID -IncludeTabularView
azure monitor
Powershell and Rest API
  • Meir_Mendelovich's avatar
    Meir_Mendelovich
    Jan 14, 2018

    Hi Brady,

     

    First, I must comment on your query. You should avoid queries that has 'search * | where Type =='. Instead the query below should just be: 'Heartbeat | take 10'. Search * is very inefficient way to use the system.

     

    Regarding the results array. I ran the same code but didn't managed to reproduce. I got both tables and results.

     

    Sorry

    Meir

8 Replies

  • Ace Eldeib's avatar
    Ace Eldeib
    Brass Contributor
    Feb 03, 2018

    Hi Brady, 

     

    The returned payload should include the results array. Can you inspect the payload using Get-Member (as shown in screenshot) to check for it? The flag -IncludeTabularView will add the tabular view, but the results array will always be on the payload. 

     

    • Brady Evans's avatar
      Brady Evans
      Copper Contributor
      Feb 05, 2018

      Thanks.  I did verify I am getting the results you indicate in the Results array is there.  The documentation for the CMDLET is a bit confusing (https://dev.loganalytics.io/documentation/Tools/PowerShell-Cmdlets) but I see what's going on now.  I also vote for a properly signed supported module here.  Thanks a lot for the help.

      • Ace Eldeib's avatar
        Ace Eldeib
        Brass Contributor
        Feb 23, 2018

        Following up on this, we've made the a cmdlet available for querying as part of the Azure RM cmdlets in the gallery. If you don't already have them, see here: https://docs.microsoft.com/en-us/powershell/azure/install-azurerm-ps?view=azurermps-5.3.0

         

        Documentation for the new cmdlet is here: https://docs.microsoft.com/en-us/powershell/module/azurerm.operationalinsights/invoke-azurermoperationalinsightsquery?view=azurermps-5.3.0

         

        Try it out and let us know what you think!

         

         

  • Mark Massad's avatar
    Mark Massad
    Icon for Microsoft rankMicrosoft
    Feb 03, 2018

    And please provide a signed version of Invoke-LogAnalyticsQuery.  Changing execution policies is not a good practice.  This command is fragile too - lots of bad gateways.  Makes it challenging to piece together data.  Thank you.

    • Ace Eldeib's avatar
      Ace Eldeib
      Brass Contributor
      Feb 03, 2018

      Thanks for the feedback Mark. We are working to provide a better set of cmdlets integrated with Azure Powershell, which will be available from the PowerShell gallery. They should be available in the next release of AzureRM PowerShell module. These should have better stability and will be signed. 

  • Meir_Mendelovich's avatar
    Meir_Mendelovich
    Icon for Microsoft rankMicrosoft
    Jan 14, 2018

    Hi Brady,

     

    First, I must comment on your query. You should avoid queries that has 'search * | where Type =='. Instead the query below should just be: 'Heartbeat | take 10'. Search * is very inefficient way to use the system.

     

    Regarding the results array. I ran the same code but didn't managed to reproduce. I got both tables and results.

     

    Sorry

    Meir

    • Brady Evans's avatar
      Brady Evans
      Copper Contributor
      Jan 16, 2018

      Meir, thanks for the pointer on query optimization.  I did figure out that I am getting the results.  It seems the shape of the JSON result you get back from Invoke-LogAnalyticsQuery doesn't match what is documented at:

      https://dev.loganalytics.io/documentation/Tools/PowerShell-Cmdlets.

       

      Thanks again.

       

Resources