Forum Discussion

Brass Contributor

Jan 31, 2024

Export Log Analytics Workspace for Timespan Locally with PowerShell

I need to export all log analytics workspace data locally for a given date range or last 30 days. I tried this PS script: $startTime = (Get-Date).AddDays(-21) $endTime = Get-Date $outputPath = "...

azure

Windows PowerShell

LainRobertson

Silver Contributor

Feb 01, 2024

GuruLee

Hi, Lee.

Have you checked you don't have multiple versions installed, where perhaps the wrong (older) module has been loaded?

You can check the cmdlet versions installed as well as which one's loaded as shown below:

I can see the parameter exists under module version 3.2.0 but I cannot perform an actual test as I don't have an insights workspace.

That said, it's enough to at least address your specific error.

One other off-topic point I'd make - as I stumbled across this while testing above (I had to install the Az.OperationalInsights prior) is that the current Az.Account module doesn't play nicely with the current Microsoft.Graph.Authentication module.

I imported Az.OperationalInsights into a session which already contained a Microsoft.Graph.Authentication session, and while Connect-AzAccount appeared to work, every Az commandlet returned the following errors:

The resolution is to ensure you open a new PowerShell or Windows Terminal application (for Windows Terminal, this means a new instance of the program, not just adding another tabbed window) to keep Microsoft.Graph.* and Az.* separate - at least for now.

Cheers,

Lain

GuruLee

Brass Contributor

Feb 01, 2024

LainRobertson I checked my instances/versions, and this is what I have:

\PS C:\Windows\system32> Get-Command -Name Invoke-AzOperationalInsightsQuery

CommandType     Name                                               Version    Source                              
-----------     ----                                               -------    ------                              
Cmdlet          Invoke-AzOperationalInsightsQuery                  3.2.0      Az.OperationalInsights

I tried re-running my cmdlet/script using either workspaceID or workspace and I still get errors:

LainRobertson
Silver Contributor
Feb 01, 2024
GuruLee

Hi, Lee.

I clearly wasn't paying close enough attention initially, as I've only just noticed that we're not dealing with the "official" commandlet, Invoke-AzOperationalInsightsQuery, but rather the community-authored commandlet (albeit written by a Microsoft employee) Invoke-AzOperationalInsightsQueryExport. I'd been referring to the former, being part of the Az.OperationalInsights module.

So, now that I've spotted my oversight, let's try again.

The two commands do not share precisely the same parameter names:

Invoke-AzOperationalInsightsQuery (Az.OperationalInsights) | Microsoft Learn
PowerShell Gallery | Invoke-AzOperationalInsightsQueryExport 1.3

Invoke-AzOperationalInsightsQuery supports these parameters:

WorkspaceId
Workspace
Timespan

While Invoke-AzOperationalInsightsQueryExport supports:

WorkspaceName
Interval

So, getting back to your screenshot of errors, the first error is accurate as these parameters you have used do not exist for Invoke-AzOperationalInsightsQueryExport:

Workspace
StartTime
EndTime
OutputPath

It's a similar story for the second error, where there is no parameter named WorkspaceId, either.

The Microsoft commandlet is the more powerful of the two, with the community commandlet being more a "convenience" commandlet that has less flexibility (which is a common trade-off with convenience commandlets).

With the Microsoft commandlet, you can indirectly specify a duration via the -Timespan parameter using this format:

-Timespan (New-TimeSpan -Days 30)

Given that Invoke-AzOperationalInsightsQueryExport is a community module that hasn't been updated since April 2020, my personal preference would be to work with the Microsoft-native commandlet instead.

Cheers,
Lain