SOLVED

Auto created saved query " - AlertIbiza"

%3CLINGO-SUB%20id%3D%22lingo-sub-199212%22%20slang%3D%22en-US%22%3EAuto%20created%20saved%20query%20%22%20-%20AlertIbiza%22%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-199212%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20anyone%20know%20why%20these%20saved%20queries%20show%20up%20in%20my%20OMS%20workspace%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThey%26nbsp%3B%20definitely%20look%20related%20to%20the%20alerts%20I%20created%2C%20but%20I'm%20curious%20as%20to%20why%20they%20got%20created.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-199212%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-200409%22%20slang%3D%22en-US%22%3ERe%3A%20Auto%20created%20saved%20query%20%22%20-%20AlertIbiza%22%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-200409%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%0A%3CP%3EWhen%20you%20create%20a%20new%20Log%20Search%20Alert%20that%20alert%20is%20based%20on%20query.%20In%20order%20the%20alert%20to%20be%20created%20first%20the%20query%20needs%20to%20be%20saved%20as%20saved%20search.%20The%20Log%20Search%20alerts%20created%20from%20Azure%20portal%20save%20their%20queries%20in%20AlertIbiza%20category.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1526344%22%20slang%3D%22en-US%22%3ERe%3A%20Auto%20created%20saved%20query%20%22%20-%20AlertIbiza%22%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1526344%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F9172%22%20target%3D%22_blank%22%3E%40Stanislav%20Zhelyazkov%3C%2FA%3E%26nbsp%3Bthis%20si%20showing%20for%20us%20too%20and%20we%20have%20not%20created.%20looks%20like%20someone%20on%20MS%20may%20have%20shared%20it%20out.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1528597%22%20slang%3D%22en-US%22%3ERe%3A%20Auto%20created%20saved%20query%20%22%20-%20AlertIbiza%22%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1528597%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F131423%22%20target%3D%22_blank%22%3E%40Brendon%20Lobo%3C%2FA%3E%20This%20is%20no%20longer%20the%20case.%20There%20is%20a%20new%20API%20for%20Log%20Analytics%20alert.%20The%20alert%20is%20now%20single%20resource%20and%20it%20contains%20the%20query%20within%20the%20alert%20properties.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Does anyone know why these saved queries show up in my OMS workspace?

 

They  definitely look related to the alerts I created, but I'm curious as to why they got created.

 

Thanks

3 Replies
best response confirmed by Stanislav Zhelyazkov (MVP)
Solution

Hi

When you create a new Log Search Alert that alert is based on query. In order the alert to be created first the query needs to be saved as saved search. The Log Search alerts created from Azure portal save their queries in AlertIbiza category.

@Stanislav Zhelyazkov this si showing for us too and we have not created. looks like someone on MS may have shared it out.

@Brendon Lobo This is no longer the case. There is a new API for Log Analytics alert. The alert is now single resource and it contains the query within the alert properties.