Export Log Analytics Workspace for Timespan Locally with PowerShell

GuruLee 

Hi, Lee.

I clearly wasn't paying close enough attention initially, as I've only just noticed that we're not dealing with the "official" commandlet, Invoke-AzOperationalInsightsQuery, but rather the community-authored commandlet (albeit written by a Microsoft employee) Invoke-AzOperationalInsightsQueryExport. I'd been referring to the former, being part of the Az.OperationalInsights module.

So, now that I've spotted my oversight, let's try again.

The two commands do not share precisely the same parameter names:

• Invoke-AzOperationalInsightsQuery (Az.OperationalInsights) | Microsoft Learn
• PowerShell Gallery | Invoke-AzOperationalInsightsQueryExport 1.3

Invoke-AzOperationalInsightsQuery supports these parameters:

• WorkspaceId
• Workspace
• Timespan

While Invoke-AzOperationalInsightsQueryExport supports:

• WorkspaceName
• Interval

So, getting back to your screenshot of errors, the first error is accurate as these parameters you have used do not exist for Invoke-AzOperationalInsightsQueryExport:

• Workspace
• StartTime
• EndTime
• OutputPath

It's a similar story for the second error, where there is no parameter named WorkspaceId, either.

The Microsoft commandlet is the more powerful of the two, with the community commandlet being more a "convenience" commandlet that has less flexibility (which is a common trade-off with convenience commandlets).

With the Microsoft commandlet, you can indirectly specify a duration via the -Timespan parameter using this format:

-Timespan (New-TimeSpan -Days 30)

Given that Invoke-AzOperationalInsightsQueryExport is a community module that hasn't been updated since April 2020, my personal preference would be to work with the Microsoft-native commandlet instead.

Cheers,

Lain