OMS log analytics allows you to save your preferred search queries and organize them under categories . All what you need is to figure out your search query then click save button in the Search bar then enter the Name and Category then hit save. How about if you have 100 of queries that you need to save in OMS ?
In this blog I will show you how to upload hundreds of queries saved in csv file to OMS using PowerShell and the latest OMS API. before you start please read Tiander Turpijn blog this will give you good understanding about OMS API and the prerequisites to use OMS PowerShell cmdlets.
In my example I have used the Service Principal to login and authenticate to my OMS workspace instead of typing my user name and password . if you need to know more how to create Service principal name , please read Tom FitzMacken’s blog
First let’s prepare the CSV file that will have the queries in excel type the following as a header: SavedSearchId, DisplayName, Category, Query
Line 8 to 11 : this is where I connect prepare the credential to connect as the service principal name.
Line 16 and 18: Initialize the variable for the Resource Group containing the workspace name you can get this information from your azure portal
Line 20: Identify the Search version for log analytics , in the MSDN it says not required, however I verified and it is required otherwise you will receive an error (Thanks to Tiander Turpijn and Jim Britt )
Line 22 : read the file and store it in an array
From line 26 to the end of the script looping in the array and creating the Queries in OMS
The Final result on PowerShell ISE
The Final result when you login to OMS