Forum Discussion
OMS Log Analytics query Function/alias creation via ARM template
Hi,
For creating function you actually use the saved searches API.
https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate
There is a slight change in the properties of the call.
"properties": { "category": " Saved Search Test Category", "displayName": "Create or Update Saved Search Test", "query": "* | measure Count() by Computer", "FunctionAlias" : "AllComputers", "version": 2 }With that you create function.
And it is just Log Analytics now. We do not use OMS anymore.
MicrosoftHi,
I am able to create saved search using ARM template. But I am not able to create function.
The resources part in my json looks like this:
"resources": [
{
"type": "Microsoft.OperationalInsights/workspaces",
"name": "[parameters('workspaceName')]",
"apiVersion": "2015-11-01-preview",
"location": "[parameters('location')]",
"properties": {
"sku": {
"Name": "[parameters('sku')]"
},
"features": {
"searchVersion": 1
}
}
},
{
"apiVersion": "2017-03-15-preview",
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"name": "[concat(parameters('workspaceName'), '/', 'ABTemplateTest')]",
"properties": {
"category": "ABTemplateTest",
"displayName": "GetVaultTest",
"query": "AzureBackupReport_CL | where Category == \"AzureBackupReport\" and OperationName == \"Vault\" | where TimeGenerated >= ago(90d) | limit 5",
"FunctionAlias" : "getvaultfunctest",
"version": 2
}
}
]
In the above resource part, without FunctionAlias, it is creating saved search successfully.
But when I include FunctionAlias, it is failing to create.
Can Functions be created via ARM template? If so, how?
Thanks.
Please provide your error. The template provided is ok.
- Vino55
Attaching error I got in powershell:
New-AzureRmResourceGroupDeployment : 2:29:43 PM - Resource Microsoft.OperationalInsights/workspaces/savedSearches 'NewTestLAWorkspaceWithFunctionAlias/ABTemplateTest' failed with message '{ "error": { "code": "ResourceNotFound", "message": "The Resource 'Microsoft.OperationalInsights/workspaces/NewTestLAWorkspaceWithFunctionAlias' under resource group 'testrg' was not found." } }' At line:1 char:1 + New-AzureRmResourceGroupDeployment -Name NewTestLA-Template -Resource ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 2:30:14 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1 + New-AzureRmResourceGroupDeployment -Name NewTestLA-Template -Resource ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 2:30:14 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1 + New-AzureRmResourceGroupDeployment -Name NewTestLA-Template -Resource ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet DeploymentName : NewTestLA-Template ResourceGroupName : testrg ProvisioningState : Failed Timestamp : 2/27/2019 9:00:11 AM Mode : Incremental TemplateLink : Parameters : Name Type Value =============== ========================= ========== workspaceName String NewTestLAWorkspaceWithFunctionAlias location String eastus sku String PerGB2018 Outputs : DeploymentDebugLogLevel :Just to add further, the exact json without that functionAlias worked for me. It created saved search.
When I add functionAlias, it threw above error. But it created workspace without any savedsearch/function.Error is clear. You do not have workspace. This is basic ARM templating but you you need first to create the workspace and than the saved search. One cannot exist without the other. Use dependsOn
- Vino55
Hi
I used the same json and provided existing workspace. It is creating function.
Thanks for the help.