Skip to content

New-AzureRmOperationalInsightsSavedSearch not able to create searches for new query language #7144

Open
@janegilring

Description

@janegilring

Description

I`ve exported the following Saved search in Log Analytics from a workspace to a JSON-file:
Category : Active Directory
DisplayName : Domain and Built-in Administrators Membership Changes
Query : SecurityEvent | where EventID==4728 or EventID==4729 or EventID==4732 or EventID==4733 or EventID==4756 or EventID==4757 or EventID==
632 or EventID==636 or EventID==660 | project InvokedBy=Account,Activity,MemberName,Group=TargetAccount
Version : 2

Using version 5.0.6 of the AzureRM.OperationalInsights PowerShell module, I get this error when trying to create a new Saved search in a different workspace from what I exported the above saved search:
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
New-AzureRmOperationalInsightsSavedSearch : 'Version' exceeds maximum value of '1'.

Isn`t the new search language supported by the AzureRM.OperationalInsights PowerShell module yet? If not, are there any ETA?

Script/Steps for Reproduction

    New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
    -DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version

Module Version

5.0.6 of the AzureRM.OperationalInsights module

Environment Data

PSVersion 5.1.17134.228
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17134.228
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions