Forum Discussion

RCDevops777's avatar
RCDevops777
Copper Contributor
Jan 25, 2019
Solved

OMS Log Analytics query Function/alias creation via ARM template

Hi All,    I have created ARM templates for creating OMS Log Analytics Searches. I am trying to see if you can help me creating a function in via ARM template. Bascially  we want to create/update t...
azure monitor
Query Language
  • Stanislav_Zhelyazkov's avatar
    Stanislav_Zhelyazkov
    Jan 30, 2019

    Hi,

    For creating function you actually use the saved searches API.

    https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate

    There is a slight change in the properties of the call.

    "properties": {
    "category": " Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "query": "* | measure Count() by Computer",
"FunctionAlias" : "AllComputers",
    "version": 2
  }

    With that you create function.

    And it is just Log Analytics now. We do not use OMS anymore.

Stanislav_Zhelyazkov's avatar
Stanislav_Zhelyazkov
MVP
Feb 27, 2019

Error is clear. You do not have workspace. This is basic ARM templating but you you need first to create the workspace and than the saved search. One cannot exist without the other. Use dependsOn

Vino55's avatar
Vino55
Icon for Microsoft rankMicrosoft
Feb 27, 2019

I just want to add that I was able to create new workspace with saved search previously.

 

Attaching entire json.

{
"$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "workspaceName": {
        "type": "String",
        "metadata": {
          "description": "Specifies the name of the workspace."
        }
    },
    "location": {
        "type": "String",
        "allowedValues": [
          "eastus",
          "westus"
        ],
        "defaultValue": "eastus",
        "metadata": {
          "description": "Specifies the location in which to create the workspace."
        }
    },
    "sku": {
        "type": "String",
        "allowedValues": [
          "Standalone",
          "PerNode",
          "PerGB2018"
        ],
        "defaultValue": "PerGB2018",
        "metadata": {
        "description": "Specifies the service tier of the workspace: Standalone, PerNode, Per-GB"
    }
      }
},
"resources": [
    {
        "type": "Microsoft.OperationalInsights/workspaces",
        "name": "[parameters('workspaceName')]",
        "apiVersion": "2015-11-01-preview",
        "location": "[parameters('location')]",
        "properties": {
            "sku": {
                "Name": "[parameters('sku')]"
            },
            "features": {
                "searchVersion": 1
            }
        }
      },
	  {
		"apiVersion": "2017-03-15-preview",
		"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
		"name": "[concat(parameters('workspaceName'), '/', 'monitoralerts-cputest')]",
		"properties": {
		"category": "BasicMonitorAlertstest",
		"displayName": "monitoralerts-cputest",
		"query": "Perf | where ObjectName == \"Processor\" and CounterName == \"% Processor Time\" | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m) | where avg_CounterValue > 95 | summarize arg_max(TimeGenerated, *) by Computer",
		"version": 2
           }
       }

   ]
}

I will anyway try with existing LA workspace and update.
Could you please elaborate on dependsOn? Any example would be great. Thanks.

Resources