Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Bicep resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01' = {
parent: resourceSymbolicName
etag: 'string'
name: 'string'
properties: {
category: 'string'
displayName: 'string'
functionAlias: 'string'
functionParameters: 'string'
query: 'string'
tags: [
{
name: 'string'
value: 'string'
}
]
version: int
}
}
Property Values
Microsoft.OperationalInsights/workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| name | The resource name | string (required) |
| parent | In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource. |
Symbolic name for resource of type: workspaces |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | Tag[] |
| version | The version number of the query language. The current version is 2 and is the default. | int |
Tag
| Name | Description | Value |
|---|---|---|
| name | The tag name. | string (required) |
| value | The tag value. | string (required) |
ARM template resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following JSON to your template.
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"apiVersion": "2025-02-01",
"name": "string",
"etag": "string",
"properties": {
"category": "string",
"displayName": "string",
"functionAlias": "string",
"functionParameters": "string",
"query": "string",
"tags": [
{
"name": "string",
"value": "string"
}
],
"version": "int"
}
}
Property Values
Microsoft.OperationalInsights/workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| apiVersion | The api version | '2025-02-01' |
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| name | The resource name | string (required) |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
| type | The resource type | 'Microsoft.OperationalInsights/workspaces/savedSearches' |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | Tag[] |
| version | The version number of the query language. The current version is 2 and is the default. | int |
Tag
| Name | Description | Value |
|---|---|---|
| name | The tag name. | string (required) |
| value | The tag value. | string (required) |
Usage Examples
Azure Quickstart Templates
The following Azure Quickstart templates deploy this resource type.
| Template | Description |
|---|---|
OMS - Azure VM Inventory Solution |
Enables Azure VM Inventory Solution in OMS. Solution collects Azure VM inventory along with disks, networking components, NSG rules and extensions into OMS workspace. |
| OMS Kemp Application Delivery |
Kemp Application Delivery solution for OMS |
Terraform (AzAPI provider) resource definition
The workspaces/savedSearches resource type can be deployed with operations that target:
- Resource groups
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.OperationalInsights/workspaces/savedSearches resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01"
name = "string"
parent_id = "string"
body = {
etag = "string"
properties = {
category = "string"
displayName = "string"
functionAlias = "string"
functionParameters = "string"
query = "string"
tags = [
{
name = "string"
value = "string"
}
]
version = int
}
}
}
Property Values
Microsoft.OperationalInsights/workspaces/savedSearches
| Name | Description | Value |
|---|---|---|
| etag | The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag | string |
| name | The resource name | string (required) |
| parent_id | The ID of the resource that is the parent for this resource. | ID for resource of type: workspaces |
| properties | The properties of the saved search. | SavedSearchProperties (required) |
| type | The resource type | "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01" |
SavedSearchProperties
| Name | Description | Value |
|---|---|---|
| category | The category of the saved search. This helps the user to find a saved search faster. | string (required) |
| displayName | Saved search display name. | string (required) |
| functionAlias | The function alias if query serves as a function. | string |
| functionParameters | The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions. | string |
| query | The query expression for the saved search. | string (required) |
| tags | The tags attached to the saved search. | Tag[] |
| version | The version number of the query language. The current version is 2 and is the default. | int |
Tag
| Name | Description | Value |
|---|---|---|
| name | The tag name. | string (required) |
| value | The tag value. | string (required) |