Azure / Azure/azure-powershell
New-AzureRmOperationalInsightsSavedSearch not able to create searches for new query language
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
I`ve exported the following Saved search in Log Analytics from a workspace to a JSON-file:
Category : Active Directory
DisplayName : Domain and Built-in Administrators Membership Changes
Query : SecurityEvent | where EventID==4728 or EventID==4729 or EventID==4732 or EventID==4733 or EventID==4756 or EventID==4757 or EventID==
632 or EventID==636 or EventID==660 | project InvokedBy=Account,Activity,MemberName,Group=TargetAccount
Version : 2
Using version 5.0.6 of the AzureRM.OperationalInsights PowerShell module, I get this error when trying to create a new Saved search in a different workspace from what I exported the above saved search:
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
New-AzureRmOperationalInsightsSavedSearch : 'Version' exceeds maximum value of '1'.
Isn`t the new search language supported by the AzureRM.OperationalInsights PowerShell module yet? If not, are there any ETA?
### Script/Steps for Reproduction
```powershell
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
```
### Module Version
5.0.6 of the AzureRM.OperationalInsights module
### Environment Data
PSVersion 5.1.17134.228
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17134.228
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Contributor guide
Assessment
This issue has not been assessed yet.