Invoke-AzureRmOperationalInsightsQuery

NAME Invoke-AzureRmOperationalInsightsQuery



SYNOPSIS

Returns search results based on the specified parameters.





SYNTAX

Invoke-AzureRmOperationalInsightsQuery [-AsJob] [-DefaultProfile <IAzureContextContainer>] [-IncludeRender] [-IncludeStatistics] -Query <String>

[-Timespan <TimeSpan>] [-Wait <Int32>] -Workspace <PSWorkspace> [<CommonParameters>]



Invoke-AzureRmOperationalInsightsQuery [-AsJob] [-DefaultProfile <IAzureContextContainer>] [-IncludeRender] [-IncludeStatistics] -Query <String>

[-Timespan <TimeSpan>] [-Wait <Int32>] -WorkspaceId <String> [<CommonParameters>]





DESCRIPTION

The Invoke-AzureRmOperationalInsightsQuery cmdlet returns the search results based on the specified parameters.



You can access the status of the search in the Metadata property of the returned object. If the status is Pending, then the search has not

completed, and the results will be from the archive.



You can retrieve the results of the search from the Value property of the returned object.





PARAMETERS

-AsJob [<SwitchParameter>]

Run cmdlet in the background



Required? false

Position? named

Default value False

Accept pipeline input? False

Accept wildcard characters? false



-DefaultProfile <IAzureContextContainer>

The credentials, account, tenant, and subscription used for communication with azure.



Required? false

Position? named

Default value None

Accept pipeline input? False

Accept wildcard characters? false



-IncludeRender [<SwitchParameter>]

If specified, rendering information for metric queries will be included in the response.



Required? false

Position? named

Default value False

Accept pipeline input? False

Accept wildcard characters? false



-IncludeStatistics [<SwitchParameter>]

If specified, query statistics will be included in the response.



Required? false

Position? named

Default value False

Accept pipeline input? False

Accept wildcard characters? false



-Query <String>

The query to execute.



Required? true

Position? named

Default value None

Accept pipeline input? False

Accept wildcard characters? false



-Timespan <TimeSpan>

The timespan to bound the query by.



Required? false

Position? named

Default value None

Accept pipeline input? False

Accept wildcard characters? false



-Wait <Int32>

Puts an upper bound on the amount of time the server will spend processing the query. See:

https://dev.loganalytics.io/documentati ... I/Timeouts



Required? false

Position? named

Default value None

Accept pipeline input? False

Accept wildcard characters? false



-Workspace <PSWorkspace>

The workspace



Required? true

Position? named

Default value None

Accept pipeline input? True (ByValue)

Accept wildcard characters? false



-WorkspaceId <String>

The workspace ID.



Required? true

Position? named

Default value None

Accept pipeline input? False

Accept wildcard characters? false



<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,

ErrorAction, ErrorVariable, WarningAction, WarningVariable,

OutBuffer, PipelineVariable, and OutVariable. For more information, see

about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).



INPUTS

Microsoft.Azure.Commands.OperationalInsights.Models.PSWorkspace

If piped in, the workspace ID will be extracted from the PSWorkspace. Otherwise you can use the workspaceId parameter to specify the workspace

ID manually.





OUTPUTS

Microsoft.Azure.Commands.OperationalInsights.Models.PSQueryResponse

The *PSQueryResponse * contains the Results, Render & Statistics of the query.





NOTES









Example 1: Get search results using a query



PS C:\\> $queryResults = Invoke-AzureRmOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query "union * | take 10"

PS C:\\> $queryResults.Results

...



Once invoked, $queryResults.Results will contain all of the resulting rows from your query.





Example 2: Convert $results.Result IEnumberable to an array



PS C:\\> $queryResults = Invoke-AzureRmOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query "union * | take 10"

PS C:\\> $resultsArray = [System.Linq.Enumerable]::ToArray($results.Results)

...



Some queries can result in very large data sets being returned. Because of this, the default behavior of the cmdlet is to return an IEnumerable to

reduce memory costs. If you'd prefer to have an array of results, you can use the LINQ Enumerable.ToArray() extension method to convert the

IEnumerable to an array.





Example 3: Get search results using a query over a specific timeframe



PS C:\\> $queryResults = Invoke-AzureRmOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query "union * | take 10"

-Timespan (New-TimeSpan -Hours 24)

PS C:\\> $queryResults.Results

...



The results from this query will be limited to the past 24 hours.





Example 4: Include render & statistics in query result



PS C:\\> $queryResults = Invoke-AzureRmOperationalInsightsQuery -WorkspaceId "63613592-b6f7-4c3d-a390-22ba13102111" -Query "union * | take 10"

-IncludeRender -IncludeStatistics

PS C:\\> $queryResults.Results

...

PS C:\\> $queryResults.Render

...

PS C:\\> $queryResults.Statistics

...



See https://dev.loganalytics.io/documentati ... estOptions

(https://dev.loganalytics.io/documentati ... estOptions)for details on the render and statistics info.







RELATED LINKS

Online Version: https://docs.microsoft.com/en-us/powers ... ightsquery