SOLVED
Home

Update saved search

Maayan Elgamil
Microsoft

Hi,

 

I am using the "Saved Search" API in order to create functions in the workspace:

https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate

 

I am trying to update the existing Searched i have created but fails to succeed.

I tried to increase the "Version" property  yet i keep getting "Newer data exists" exception.

 

What is the correct way to update existing "Saved Search"?

 

Thanks,

Maayan.

1 Reply
Solution

Hi,

In the example given:

{
  "properties": {
    "category": "category",
    "displayName": "Create or Update Saved Search Test",
    "query": "*",
    "version": 1,
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

the version is not something you should change. This is not the version of the query instance but it is rather the version of the query language. In your case it should be version 2.

 

Better example is posted here:

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions-resources-searches-alerts

{
    "name": "[concat(parameters('workspaceName'), '/', variables('SavedSearch').Name)]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
    "apiVersion": "[variables('LogAnalyticsApiVersion')]",
    "dependsOn": [
    ],
    "tags": { },
    "properties": {
        "etag": "*",
        "query": "[variables('SavedSearch').Query]",
        "displayName": "[variables('SavedSearch').DisplayName]",
        "category": "[variables('SavedSearch').Category]"
    }
}

where as you can see you do not have to specify the version at all. It is important also to use api version 2017-03-15-preview and property etag with value * as in the example above.