< Back
Invoke-OMSSavedSearch
Post
NAME Invoke-OMSSavedSearch
SYNOPSIS
Return the results from a named saved search.
SYNTAX
Invoke-OMSSavedSearch [-Token] <String> [-SubscriptionID] <String> [-ResourceGroupName] <String>
[-OMSWorkspaceName] <String> [-QueryName] <String> [[-Top] <Int32>] [[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-SubscriptionID] <String> [-ResourceGroupName] <String>
[-OMSWorkspaceName] <String> [-QueryName] <String> [[-Top] <Int32>] [-Start] <String> [-End] <String>
[[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-OMSConnection] <Object> [-QueryName] <String> [[-Top] <Int32>] [-Start]
<String> [-End] <String> [[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-OMSConnection] <Object> [-QueryName] <String> [[-Top] <Int32>]
[[-APIVersion] <String>] [<CommonParameters>]
DESCRIPTION
Gets results from Saved Search.
PARAMETERS
-Token <String>
Token aquired from Get-AADToken cmdlet.
Required? true
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
-OMSConnection <Object>
Object that contains all needed parameters for working
with OMSSearch Module. You can create such object in
OMS Automation as connection asset.
Required? true
Position? 2
Default value
Accept pipeline input? false
Accept wildcard characters? false
-SubscriptionID <String>
Azure Subscription ID where the OMS workspace
is located.
Required? true
Position? 2
Default value
Accept pipeline input? false
Accept wildcard characters? false
-ResourceGroupName <String>
Azure Resource Group Name where the OMS
workspace is located.
Required? true
Position? 3
Default value
Accept pipeline input? false
Accept wildcard characters? false
-OMSWorkspaceName <String>
Name of the OMS workspace.
Required? true
Position? 4
Default value
Accept pipeline input? false
Accept wildcard characters? false
-QueryName <String>
Specify the full name of OMS Saved Search to get
only specific query.
Required? true
Position? 5
Default value
Accept pipeline input? false
Accept wildcard characters? false
-Top <Int32>
Maximum number of restults to be returned
from the query. If not specified 10 results
will be returned.
Example: 200
Required? false
Position? 6
Default value 10
Accept pipeline input? false
Accept wildcard characters? false
-Start <String>
Date/Time string in format yyyy-MM-ddTHH:mm:ss.fffZ
Start and End paramteres specify the interval for
which the query should return results.
Example: 2016-01-17T08:33:55.864Z
Required? true
Position? 7
Default value
Accept pipeline input? false
Accept wildcard characters? false
-End <String>
Date/Time string in format yyyy-MM-ddTHH:mm:ss.fffZ
Start and End paramteres specify the interval for
which the query should return results.
Example: 2016-01-17T14:34:16.953Z
Required? true
Position? 8
Default value
Accept pipeline input? false
Accept wildcard characters? false
-APIVersion <String>
Api version for microsoft.operationalinsights
Azure Resource provider.
Required? false
Position? 9
Default value 2015-03-20
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
System.Object. Returns array of objects. Each object
is result from the query executed. Properties of each
object depend on the type of data returned.
For example result from Perf Type can look like this:
Key Value
--- -----
Computer CENTOS7
ObjectName Processor
CounterName % Processor Time
InstanceName _Total
Min 0,0
Max 1,0
SampleCount 45
TimeGenerated 2016-01-11T21:13:52Z
BucketStartTime 2016-01-11T21:05:39Z
BucketEndTime 2016-01-11T21:13:52Z
SourceSystem OpsManager
CounterPath \\\\CENTOS7\\Processor(_Total)\\% Processor Time
StandardDeviation 0,339934634239519
MG 00000000-0000-0000-0000-000000000002
id 8530a411-23bd-e980-04ae-b5dc6fffa365
Type Perf
CounterValue 0,866666666666667
__metadata {[Type, Perf], [TimeGenerated, 2016-01-11T21:13:52Z]}
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Invoke-OMSSavedSearch -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName'
Description
-----------
Executes Saved Search against OMS
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Invoke-OMSSearchQuery -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName' -Top $NumberOfResults -Start $StartTime
-End $EndTime
Description
-----------
Executes Saved Search against OMS
Specify End and Start date as well as maximum number of returned reuslts
Returns results from the saved search
Example Variables
-----------------
# Gets Saved Searches from OMS. Returns results.
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
$NumberOfResults = 150
$StartTime = (((get-date)).AddHours(-6).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$EndTime = ((get-date).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Invoke-OMSSavedSearch -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName' -APIVersion '2015-03-20'
Description
-----------
Executes Saved Search against OMS
Uses specific version of Operational Insights API
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
-------------------------- EXAMPLE 4 --------------------------
PS C:\\>Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName'
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName'
-------------------------- EXAMPLE 5 --------------------------
PS C:\\>Invoke-OMSSearchQuery -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName' -Top
$NumberOfResults -Start $StartTime -End $EndTime
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Specify End and Start date as well as maximum number of returned reuslts
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$NumberOfResults = 150
$StartTime = (((get-date)).AddHours(-6).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$EndTime = ((get-date).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
-------------------------- EXAMPLE 6 --------------------------
PS C:\\>Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName' -APIVersion
'2015-03-20'
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Uses specific version of Operational Insights API
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
RELATED LINKS
SYNOPSIS
Return the results from a named saved search.
SYNTAX
Invoke-OMSSavedSearch [-Token] <String> [-SubscriptionID] <String> [-ResourceGroupName] <String>
[-OMSWorkspaceName] <String> [-QueryName] <String> [[-Top] <Int32>] [[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-SubscriptionID] <String> [-ResourceGroupName] <String>
[-OMSWorkspaceName] <String> [-QueryName] <String> [[-Top] <Int32>] [-Start] <String> [-End] <String>
[[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-OMSConnection] <Object> [-QueryName] <String> [[-Top] <Int32>] [-Start]
<String> [-End] <String> [[-APIVersion] <String>] [<CommonParameters>]
Invoke-OMSSavedSearch [-Token] <String> [-OMSConnection] <Object> [-QueryName] <String> [[-Top] <Int32>]
[[-APIVersion] <String>] [<CommonParameters>]
DESCRIPTION
Gets results from Saved Search.
PARAMETERS
-Token <String>
Token aquired from Get-AADToken cmdlet.
Required? true
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
-OMSConnection <Object>
Object that contains all needed parameters for working
with OMSSearch Module. You can create such object in
OMS Automation as connection asset.
Required? true
Position? 2
Default value
Accept pipeline input? false
Accept wildcard characters? false
-SubscriptionID <String>
Azure Subscription ID where the OMS workspace
is located.
Required? true
Position? 2
Default value
Accept pipeline input? false
Accept wildcard characters? false
-ResourceGroupName <String>
Azure Resource Group Name where the OMS
workspace is located.
Required? true
Position? 3
Default value
Accept pipeline input? false
Accept wildcard characters? false
-OMSWorkspaceName <String>
Name of the OMS workspace.
Required? true
Position? 4
Default value
Accept pipeline input? false
Accept wildcard characters? false
-QueryName <String>
Specify the full name of OMS Saved Search to get
only specific query.
Required? true
Position? 5
Default value
Accept pipeline input? false
Accept wildcard characters? false
-Top <Int32>
Maximum number of restults to be returned
from the query. If not specified 10 results
will be returned.
Example: 200
Required? false
Position? 6
Default value 10
Accept pipeline input? false
Accept wildcard characters? false
-Start <String>
Date/Time string in format yyyy-MM-ddTHH:mm:ss.fffZ
Start and End paramteres specify the interval for
which the query should return results.
Example: 2016-01-17T08:33:55.864Z
Required? true
Position? 7
Default value
Accept pipeline input? false
Accept wildcard characters? false
-End <String>
Date/Time string in format yyyy-MM-ddTHH:mm:ss.fffZ
Start and End paramteres specify the interval for
which the query should return results.
Example: 2016-01-17T14:34:16.953Z
Required? true
Position? 8
Default value
Accept pipeline input? false
Accept wildcard characters? false
-APIVersion <String>
Api version for microsoft.operationalinsights
Azure Resource provider.
Required? false
Position? 9
Default value 2015-03-20
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
System.Object. Returns array of objects. Each object
is result from the query executed. Properties of each
object depend on the type of data returned.
For example result from Perf Type can look like this:
Key Value
--- -----
Computer CENTOS7
ObjectName Processor
CounterName % Processor Time
InstanceName _Total
Min 0,0
Max 1,0
SampleCount 45
TimeGenerated 2016-01-11T21:13:52Z
BucketStartTime 2016-01-11T21:05:39Z
BucketEndTime 2016-01-11T21:13:52Z
SourceSystem OpsManager
CounterPath \\\\CENTOS7\\Processor(_Total)\\% Processor Time
StandardDeviation 0,339934634239519
MG 00000000-0000-0000-0000-000000000002
id 8530a411-23bd-e980-04ae-b5dc6fffa365
Type Perf
CounterValue 0,866666666666667
__metadata {[Type, Perf], [TimeGenerated, 2016-01-11T21:13:52Z]}
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Invoke-OMSSavedSearch -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName'
Description
-----------
Executes Saved Search against OMS
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Invoke-OMSSearchQuery -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName' -Top $NumberOfResults -Start $StartTime
-End $EndTime
Description
-----------
Executes Saved Search against OMS
Specify End and Start date as well as maximum number of returned reuslts
Returns results from the saved search
Example Variables
-----------------
# Gets Saved Searches from OMS. Returns results.
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
$NumberOfResults = 150
$StartTime = (((get-date)).AddHours(-6).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$EndTime = ((get-date).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Invoke-OMSSavedSearch -SubscriptionID $subscriptionId -ResourceGroupName $ResourceGroupName
-OMSWorkspaceName $OMSWorkspace -Token $Token -QueryName 'SavedQueryName' -APIVersion '2015-03-20'
Description
-----------
Executes Saved Search against OMS
Uses specific version of Operational Insights API
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$subscriptionId = "3c1d68a5-4064-4522-94e4-e0378165555e"
$ResourceGroupName = "oi-default-east-us"
$OMSWorkspace = "Test"
-------------------------- EXAMPLE 4 --------------------------
PS C:\\>Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName'
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName'
-------------------------- EXAMPLE 5 --------------------------
PS C:\\>Invoke-OMSSearchQuery -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName' -Top
$NumberOfResults -Start $StartTime -End $EndTime
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Specify End and Start date as well as maximum number of returned reuslts
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
$NumberOfResults = 150
$StartTime = (((get-date)).AddHours(-6).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$EndTime = ((get-date).ToUniversalTime()).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
-------------------------- EXAMPLE 6 --------------------------
PS C:\\>Invoke-OMSSavedSearch -OMSConnection $OMSCon -Token $Token -QueryName 'SavedQueryName' -APIVersion
'2015-03-20'
Description
-----------
Executes Saved Search against OMS by using information from asset of type connection in OMS Automation
Uses specific version of Operational Insights API
Returns results from the saved search
Example Variables
-----------------
$OMSCon = Get-AutomationConnection -Name 'OMSCon'
$Token = Get-AADToken -OMSConnection $OMSCon
RELATED LINKS