Saved Searches - Create Or Update

Service:: Log Analytics

API Version:: 2025-07-01

Creates or updates a saved search for a given workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/savedSearches/{savedSearchId}?api-version=2025-07-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
savedSearchId	path	True	string	The id of the saved search.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Required	Type	Description
properties.category	True	string	The category of the saved search. This helps the user to find a saved search faster.
properties.displayName	True	string	Saved search display name.
properties.query	True	string	The query expression for the saved search.
etag		string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
properties.functionAlias		string	The function alias if query serves as a function.
properties.functionParameters		string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.
properties.tags		Tag[]	The tags attached to the saved search.
properties.version		integer (int64)	The version number of the query language. The current version is 2 and is the default.

Responses

Name	Type	Description
200 OK	SavedSearch	OK response definition.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

SavedSearchCreateOrUpdate

Sample request

HTTP

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/TestRG/providers/Microsoft.OperationalInsights/workspaces/TestWS/savedSearches/00000000-0000-0000-0000-00000000000?api-version=2025-07-01

{
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "version": 2,
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "tags": [
      {
        "name": "Group",
        "value": "Computer"
      }
    ]
  }
}

Sample response

Status code:: 200

{
  "id": "subscriptions/00000000-0000-0000-0000-000000000005/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/AtlantisDemo/savedSearches/test-new-saved-search-id-2015",
  "etag": "W/\"datetime'2017-10-02T23%3A15%3A41.0709875Z'\"",
  "properties": {
    "category": "Saved Search Test Category",
    "displayName": "Create or Update Saved Search Test",
    "functionAlias": "heartbeat_func",
    "functionParameters": "a:int=1",
    "query": "Heartbeat | summarize Count() by Computer | take a",
    "version": 2
  }
}

Definitions

Name	Description
SavedSearch	Value object for saved search results.
Tag	A tag of a saved search.

SavedSearch

Object

Value object for saved search results.

Name	Type	Description
etag	string	The ETag of the saved search. To override an existing saved search, use "*" or specify the current Etag
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	The name of the resource
properties.category	string	The category of the saved search. This helps the user to find a saved search faster.
properties.displayName	string	Saved search display name.
properties.functionAlias	string	The function alias if query serves as a function.
properties.functionParameters	string	The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.
properties.query	string	The query expression for the saved search.
properties.tags	Tag[]	The tags attached to the saved search.
properties.version	integer (int64)	The version number of the query language. The current version is 2 and is the default.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

Tag