SOLVED
Home

Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Highlighted
Brady Evans
Occasional Contributor

Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

I'm trying to use the new PowerShell based API (Invoke-LogAnalyticsQuery - see below) and the return payload only includes the Tables array and not the Results array as documented..  

 

import-module .\LogAnalyticsQuery.psm1

$queryString = 'search * | where Type == "Heartbeat" | take 10'
$workspaceName = "xxxx"
$resourceGroupName = "xxxx"
$subscriptionID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

$response = invoke-loganalyticsquery -WorkspaceName $workspaceName -ResourceGroup $resourceGroupName -Query $queryString -SubscriptionId $subscriptionID -IncludeTabularView
8 Replies
Solution

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Hi Brady,

 

First, I must comment on your query. You should avoid queries that has 'search * | where Type =='. Instead the query below should just be: 'Heartbeat | take 10'. Search * is very inefficient way to use the system.

 

Regarding the results array. I ran the same code but didn't managed to reproduce. I got both tables and results.

 

Sorry

Meir

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Meir, thanks for the pointer on query optimization.  I did figure out that I am getting the results.  It seems the shape of the JSON result you get back from Invoke-LogAnalyticsQuery doesn't match what is documented at:

https://dev.loganalytics.io/documentation/Tools/PowerShell-Cmdlets.

 

Thanks again.

 

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Adding @Chris Suich

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

And please provide a signed version of Invoke-LogAnalyticsQuery.  Changing execution policies is not a good practice.  This command is fragile too - lots of bad gateways.  Makes it challenging to piece together data.  Thank you.

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Hi Brady, 

 

The returned payload should include the results array. Can you inspect the payload using Get-Member (as shown in screenshot) to check for it? The flag -IncludeTabularView will add the tabular view, but the results array will always be on the payload. 

 

ps.png

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Thanks for the feedback Mark. We are working to provide a better set of cmdlets integrated with Azure Powershell, which will be available from the PowerShell gallery. They should be available in the next release of AzureRM PowerShell module. These should have better stability and will be signed. 

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Thanks.  I did verify I am getting the results you indicate in the Results array is there.  The documentation for the CMDLET is a bit confusing (https://dev.loganalytics.io/documentation/Tools/PowerShell-Cmdlets) but I see what's going on now.  I also vote for a properly signed supported module here.  Thanks a lot for the help.

Re: Invoke-LogAnalyticsQuery only returns Tables JSON Array and not Results Array

Following up on this, we've made the a cmdlet available for querying as part of the Azure RM cmdlets in the gallery. If you don't already have them, see here: https://docs.microsoft.com/en-us/powershell/azure/install-azurerm-ps?view=azurermps-5.3.0

 

Documentation for the new cmdlet is here: https://docs.microsoft.com/en-us/powershell/module/azurerm.operationalinsights/invoke-azurermoperati...

 

Try it out and let us know what you think!