Description
Description
I`ve exported the following Saved search in Log Analytics from a workspace to a JSON-file:
Category : Active Directory
DisplayName : Domain and Built-in Administrators Membership Changes
Query : SecurityEvent | where EventID==4728 or EventID==4729 or EventID==4732 or EventID==4733 or EventID==4756 or EventID==4757 or EventID==
632 or EventID==636 or EventID==660 | project InvokedBy=Account,Activity,MemberName,Group=TargetAccount
Version : 2
Using version 5.0.6 of the AzureRM.OperationalInsights PowerShell module, I get this error when trying to create a new Saved search in a different workspace from what I exported the above saved search:
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
New-AzureRmOperationalInsightsSavedSearch : 'Version' exceeds maximum value of '1'.
Isn`t the new search language supported by the AzureRM.OperationalInsights PowerShell module yet? If not, are there any ETA?
Script/Steps for Reproduction
New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $ResourceRG -WorkspaceName $WorkspaceName -SavedSearchId $id `
-DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
Module Version
5.0.6 of the AzureRM.OperationalInsights module
Environment Data
PSVersion 5.1.17134.228
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17134.228
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1