Jan 31 2019
05:02 AM
- last edited on
Apr 07 2022
05:37 PM
by
TechCommunityAP
Jan 31 2019
05:02 AM
- last edited on
Apr 07 2022
05:37 PM
by
TechCommunityAP
Hi,
I am using the "Saved Search" API in order to create functions in the workspace:
https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate
I am trying to update the existing Searched i have created but fails to succeed.
I tried to increase the "Version" property yet i keep getting "Newer data exists" exception.
What is the correct way to update existing "Saved Search"?
Thanks,
Maayan.
Feb 01 2019 12:04 AM
SolutionHi,
In the example given:
{ "properties": { "category": "category", "displayName": "Create or Update Saved Search Test", "query": "*", "version": 1, "tags": [ { "name": "Group", "value": "Computer" } ] } }
the version is not something you should change. This is not the version of the query instance but it is rather the version of the query language. In your case it should be version 2.
Better example is posted here:
https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions-resources-searches-alerts
{ "name": "[concat(parameters('workspaceName'), '/', variables('SavedSearch').Name)]", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "[variables('LogAnalyticsApiVersion')]", "dependsOn": [ ], "tags": { }, "properties": { "etag": "*", "query": "[variables('SavedSearch').Query]", "displayName": "[variables('SavedSearch').DisplayName]", "category": "[variables('SavedSearch').Category]" } }
where as you can see you do not have to specify the version at all. It is important also to use api version 2017-03-15-preview and property etag with value * as in the example above.
Feb 01 2019 12:04 AM
SolutionHi,
In the example given:
{ "properties": { "category": "category", "displayName": "Create or Update Saved Search Test", "query": "*", "version": 1, "tags": [ { "name": "Group", "value": "Computer" } ] } }
the version is not something you should change. This is not the version of the query instance but it is rather the version of the query language. In your case it should be version 2.
Better example is posted here:
https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions-resources-searches-alerts
{ "name": "[concat(parameters('workspaceName'), '/', variables('SavedSearch').Name)]", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "[variables('LogAnalyticsApiVersion')]", "dependsOn": [ ], "tags": { }, "properties": { "etag": "*", "query": "[variables('SavedSearch').Query]", "displayName": "[variables('SavedSearch').DisplayName]", "category": "[variables('SavedSearch').Category]" } }
where as you can see you do not have to specify the version at all. It is important also to use api version 2017-03-15-preview and property etag with value * as in the example above.