Get-AzureRMOperationalInsightsSavedSearchResults doesn't return full search results when retrieving ServiceMap data.

[bmilbauer]

Cmdlet(s)

Get-AzureRmOperationalInsightsSavedSearchResults

PowerShell Version

Instructions: to get PowerShell version, type $PSVersionTable and look for the value associated with 5.1.14409.1005

Module Version

3.8.0

OS Version

10.0.14409.1005

Description

Get-AzureRMOperationalInsightsSavedSearchResults doesn't return full search results when retrieving ServiceMap data. I'm trying to retrieve a shared search with a list of unique Service Map computers from Operational Insights/Log Analytics. When I retrieve the shared search via cmdlet, I only get 12 rows back vs the expected 1700+.

Debug Output

Almost all this data is sensitive and will not be posted publicly. Don't have time to set up new lab.

Script/Steps for Reproduction

1. Connect via browser to OMS workspace with ServiceMap data
2. Create saved search "foo" with syntax "Type=ServiceMapComputer_CL | dedup ResourceId"
3. Retrieve search results with "((Get-AzureRmOperationalInsightsSavedSearchResults -ResourceGroupName -WorkspaceName -SavedSearchId "foo").Value | ConvertFrom-Json)"
4. Note number of records retrieved - I received 10 rows via cmdlets when exporting csv from web gives ~1700

The purpose of step 2 is to obtain a list of unique computers in ServiceMap per https://docs.microsoft.com/en-us/azure/operations-management-suite/operations-management-suite-service-map?toc=%2fazure%2flog-analytics%2ftoc.json#sample-log-searches. My OMS workspace has ~1700 of these computers. The browser-based query returns accurate results, but the cmdlets only return 12 rows of computer records.

[sphibbs]

@twitchax we need a contact for operational insights.

[twitchax]

Sent mail!

[segmentation-violation]

When using the API it is important to make sure that if the result set is "Pending" you query again to get the remaining results - refer to Example #3 on https://docs.microsoft.com/en-us/powershell/module/azurerm.operationalinsights/get-azurermoperationalinsightssearchresults?view=azurermps-3.8.0

The UI will automatically wait for all results to return which can be why you see a difference between the UI export to CSV and calling the API.

[twitchax]

Thanks, @richrundmsft! Closing...