Azure / Azure/azure-powershell

New-AzureRmOperationalInsightsSavedSearch not able to create searches for new query language

Open
#7,144 1 comment 0 reactions 1 assignee Claimed by @xizha162 View on GitHub
Monitor - Operational Insights Scenario Candidate Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

I`ve exported the following Saved search in Log Analytics from a workspace to a JSON-file:
Category : Active Directory
DisplayName : Domain and Built-in Administrators Membership Changes
Query : SecurityEvent | where EventID==4728 or EventID==4729 or EventID==4732 or EventID==4733 or EventID==4756 or EventID==4757 or EventID==
632 or EventID==636 or EventID==660 | project InvokedBy=Account,Activity,MemberName,Group=TargetAccount
Version : 2

Using version 5.0.6 of the AzureRM.OperationalInsights PowerShell module, I get this error when trying to create a new Saved search in a different workspace from what I exported the above saved search:
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
New-AzureRmOperationalInsightsSavedSearch : 'Version' exceeds maximum value of '1'.

Isn`t the new search language supported by the AzureRM.OperationalInsights PowerShell module yet? If not, are there any ETA?

### Script/Steps for Reproduction

```powershell
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
```

### Module Version
5.0.6 of the AzureRM.OperationalInsights module

### Environment Data

PSVersion 5.1.17134.228
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17134.228
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.