SOLVED
Home

Update saved search

%3CLINGO-SUB%20id%3D%22lingo-sub-328553%22%20slang%3D%22en-US%22%3EUpdate%20saved%20search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-328553%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20am%20using%20the%20%22Saved%20Search%22%20API%20in%20order%20to%20create%20functions%20in%20the%20workspace%3A%3C%2FP%3E%0A%3CP%3E%3CA%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%2Fcreateorupdate%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%2Fcreateorupdate%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%2Fcreateorupdate%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20am%20trying%20to%20update%20the%20existing%20Searched%20i%20have%20created%20but%20fails%20to%20succeed.%3C%2FP%3E%0A%3CP%3EI%20tried%20to%20increase%20the%20%22Version%22%20property%26nbsp%3B%20yet%20i%20keep%20getting%20%22Newer%20data%20exists%22%20exception.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhat%20is%20the%20correct%20way%20to%20update%20existing%20%22Saved%20Search%22%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EMaayan.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-328553%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-329223%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20saved%20search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-329223%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EIn%20the%20example%20given%3A%3C%2FP%3E%0A%3CPRE%3E%7B%0A%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%22category%22%3A%20%22category%22%2C%0A%20%20%20%20%22displayName%22%3A%20%22Create%20or%20Update%20Saved%20Search%20Test%22%2C%0A%20%20%20%20%22query%22%3A%20%22*%22%2C%0A%20%20%20%20%22version%22%3A%201%2C%0A%20%20%20%20%22tags%22%3A%20%5B%0A%20%20%20%20%20%20%7B%0A%20%20%20%20%20%20%20%20%22name%22%3A%20%22Group%22%2C%0A%20%20%20%20%20%20%20%20%22value%22%3A%20%22Computer%22%0A%20%20%20%20%20%20%7D%0A%20%20%20%20%5D%0A%20%20%7D%0A%7D%3C%2FPRE%3E%0A%3CP%3Ethe%20version%20is%20not%20something%20you%20should%20change.%20This%20is%20not%20the%20version%20of%20the%20query%20instance%20but%20it%20is%20rather%20the%20version%20of%20the%20query%20language.%20In%20your%20case%20it%20should%20be%20version%202.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBetter%20example%20is%20posted%20here%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Finsights%2Fsolutions-resources-searches-alerts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Finsights%2Fsolutions-resources-searches-alerts%3C%2FA%3E%3C%2FP%3E%0A%3CPRE%3E%7B%0A%20%20%20%20%22name%22%3A%20%22%5Bconcat(parameters('workspaceName')%2C%20'%2F'%2C%20variables('SavedSearch').Name)%5D%22%2C%0A%20%20%20%20%22type%22%3A%20%22Microsoft.OperationalInsights%2Fworkspaces%2FsavedSearches%22%2C%0A%20%20%20%20%22apiVersion%22%3A%20%22%5Bvariables('LogAnalyticsApiVersion')%5D%22%2C%0A%20%20%20%20%22dependsOn%22%3A%20%5B%0A%20%20%20%20%5D%2C%0A%20%20%20%20%22tags%22%3A%20%7B%20%7D%2C%0A%20%20%20%20%22properties%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22etag%22%3A%20%22*%22%2C%0A%20%20%20%20%20%20%20%20%22query%22%3A%20%22%5Bvariables('SavedSearch').Query%5D%22%2C%0A%20%20%20%20%20%20%20%20%22displayName%22%3A%20%22%5Bvariables('SavedSearch').DisplayName%5D%22%2C%0A%20%20%20%20%20%20%20%20%22category%22%3A%20%22%5Bvariables('SavedSearch').Category%5D%22%0A%20%20%20%20%7D%0A%7D%3C%2FPRE%3E%0A%3CP%3Ewhere%20as%20you%20can%20see%20you%20do%20not%20have%20to%20specify%20the%20version%20at%20all.%20It%20is%20important%20also%20to%20use%20api%20version%202017-03-15-preview%20and%20property%20etag%20with%20value%20*%20as%20in%20the%20example%20above.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Maayan Elgamil
Microsoft

Hi,

 

I am using the "Saved Search" API in order to create functions in the workspace:

https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate

 

I am trying to update the existing Searched i have created but fails to succeed.

I tried to increase the "Version" property  yet i keep getting "Newer data exists" exception.

 

What is the correct way to update existing "Saved Search"?

 

Thanks,

Maayan.

1 Reply
Highlighted
Solution

Hi,

In the example given:

{
  "properties": {
    "category": "category",
    "displayName": "Create or Update Saved Search Test",
    "query": "*",
    "version": 1,
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

the version is not something you should change. This is not the version of the query instance but it is rather the version of the query language. In your case it should be version 2.

 

Better example is posted here:

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions-resources-searches-alerts

{
    "name": "[concat(parameters('workspaceName'), '/', variables('SavedSearch').Name)]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
    "apiVersion": "[variables('LogAnalyticsApiVersion')]",
    "dependsOn": [
    ],
    "tags": { },
    "properties": {
        "etag": "*",
        "query": "[variables('SavedSearch').Query]",
        "displayName": "[variables('SavedSearch').DisplayName]",
        "category": "[variables('SavedSearch').Category]"
    }
}

where as you can see you do not have to specify the version at all. It is important also to use api version 2017-03-15-preview and property etag with value * as in the example above.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies