Update saved search

[Maayan Elgamil]

Hi,

I am using the "Saved Search" API in order to create functions in the workspace:

https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches/createorupdate

I am trying to update the existing Searched i have created but fails to succeed.

I tried to increase the "Version" property  yet i keep getting "Newer data exists" exception.

What is the correct way to update existing "Saved Search"?

Thanks,

Maayan.

[#2 · Accepted solution]

Hi,

In the example given:

{
  "properties": {
    "category": "category",
    "displayName": "Create or Update Saved Search Test",
    "query": "*",
    "version": 1,
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

the version is not something you should change. This is not the version of the query instance but it is rather the version of the query language. In your case it should be version 2.

Better example is posted here:

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions-resources-searches-alerts

{
    "name": "[concat(parameters('workspaceName'), '/', variables('SavedSearch').Name)]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
    "apiVersion": "[variables('LogAnalyticsApiVersion')]",
    "dependsOn": [
    ],
    "tags": { },
    "properties": {
        "etag": "*",
        "query": "[variables('SavedSearch').Query]",
        "displayName": "[variables('SavedSearch').DisplayName]",
        "category": "[variables('SavedSearch').Category]"
    }
}

where as you can see you do not have to specify the version at all. It is important also to use api version 2017-03-15-preview and property etag with value * as in the example above.