Forum Discussion
Export Log Analytics Workspace for Timespan Locally with PowerShell
I need to export all log analytics workspace data locally for a given date range or last 30 days. I tried this PS script:
$startTime = (Get-Date).AddDays(-21)
$endTime = Get-Date
$outputPath = "c:\Temp\azure-logs\"
Invoke-AzOperationalInsightsQueryExport -WorkspaceId <myworkspaceID> -Query "*" -StartTime $startTime -EndTime $endTime -OutputPath $outputPath
But it returns this error:
Invoke-AzOperationalInsightsQueryExport.ps1 : A parameter cannot be found that matches parameter name 'WorkspaceId'.
At line:1 char:41
+ Invoke-AzOperationalInsightsQueryExport -WorkspaceId "xxxxxxx ...
+ ~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-AzOperat...QueryExport.ps1], ParameterBindingException
+ FullyQualifiedErrorId : NamedParameterNotFound,Invoke-AzOperationalInsightsQueryExport.ps1
How can I export all data from a log analytics workspace for a specific date range within the last 30 days locally using PS, or if there is another way?
Hi, Lee.
Have you checked you don't have multiple versions installed, where perhaps the wrong (older) module has been loaded?
You can check the cmdlet versions installed as well as which one's loaded as shown below:
I can see the parameter exists under module version 3.2.0 but I cannot perform an actual test as I don't have an insights workspace.
That said, it's enough to at least address your specific error.
One other off-topic point I'd make - as I stumbled across this while testing above (I had to install the Az.OperationalInsights prior) is that the current Az.Account module doesn't play nicely with the current Microsoft.Graph.Authentication module.
I imported Az.OperationalInsights into a session which already contained a Microsoft.Graph.Authentication session, and while Connect-AzAccount appeared to work, every Az commandlet returned the following errors:
The resolution is to ensure you open a new PowerShell or Windows Terminal application (for Windows Terminal, this means a new instance of the program, not just adding another tabbed window) to keep Microsoft.Graph.* and Az.* separate - at least for now.
Cheers,
Lain
LainRobertson I checked my instances/versions, and this is what I have:
\PS C:\Windows\system32> Get-Command -Name Invoke-AzOperationalInsightsQuery CommandType Name Version Source ----------- ---- ------- ------ Cmdlet Invoke-AzOperationalInsightsQuery 3.2.0 Az.OperationalInsightsI tried re-running my cmdlet/script using either workspaceID or workspace and I still get errors:
Hi, Lee.
I clearly wasn't paying close enough attention initially, as I've only just noticed that we're not dealing with the "official" commandlet, Invoke-AzOperationalInsightsQuery, but rather the community-authored commandlet (albeit written by a Microsoft employee) Invoke-AzOperationalInsightsQueryExport. I'd been referring to the former, being part of the Az.OperationalInsights module.
So, now that I've spotted my oversight, let's try again.
The two commands do not share precisely the same parameter names:
- Invoke-AzOperationalInsightsQuery (Az.OperationalInsights) | Microsoft Learn
- PowerShell Gallery | Invoke-AzOperationalInsightsQueryExport 1.3
Invoke-AzOperationalInsightsQuery supports these parameters:
- WorkspaceId
- Workspace
- Timespan
While Invoke-AzOperationalInsightsQueryExport supports:
- WorkspaceName
- Interval
So, getting back to your screenshot of errors, the first error is accurate as these parameters you have used do not exist for Invoke-AzOperationalInsightsQueryExport:
- Workspace
- StartTime
- EndTime
- OutputPath
It's a similar story for the second error, where there is no parameter named WorkspaceId, either.
The Microsoft commandlet is the more powerful of the two, with the community commandlet being more a "convenience" commandlet that has less flexibility (which is a common trade-off with convenience commandlets).
With the Microsoft commandlet, you can indirectly specify a duration via the -Timespan parameter using this format:
-Timespan (New-TimeSpan -Days 30)Given that Invoke-AzOperationalInsightsQueryExport is a community module that hasn't been updated since April 2020, my personal preference would be to work with the Microsoft-native commandlet instead.
Cheers,
Lain
