Get Saved Searches

description retrieves a specific saved search from a microsoft azure sentinel workspace using resource group, search id, subscription, and workspace name endpoint url /subscriptions/{{subscriptionid}}/resourcegroups/{{resourcegroupname}}/providers/microsoft operationalinsights/workspaces/{{workspacename}}/savedsearches/{{savedsearchid}} method get inputs path parameters (object) – required resourcegroupname (string) – required savedsearchid (string) – required subscriptionid (string) – required workspacename (string) – required parameters (object) – required api version (string) – required output example \[ { "status code" 200, "response headers" { "cache control" "no cache", "pragma" "no cache", "content type" "application/json; charset=utf 8", "expires" " 1", "x ms failure cause" "gateway", "x ms request id" "54b36bb1 0d41 45b8 a8ba 6f4552f3c8fe", "x ms correlation request id" "54b36bb1 0d41 45b8 a8ba 6f4552f3c8fe", "x ms routing request id" "jioindiacentral 20230810t090934z 54b36bb1 0d41 45b8 a8ba 6f4552f3c8fe", "strict transport security" "max age=31536000; includesubdomains", "x content type options" "nosniff", "date" "thu, 10 aug 2023 09 09 34 gmt", "content length" "139" }, "reason" "ok", "json body" { "id" "subscriptions/00000000 0000 0000 0000 000000000005/resourcegroups/mms eus/providers/microsoft operationalinsights/workspaces/atlantisdemo/savedsearches/test new saved search id 2015", "etag" "w/\\"datetime'2017 10 02t23%3a15%3a41 0709875z'\\"", "properties" { "category" " saved search test category", "displayname" "create or update saved search test", "functionalias" "heartbeat func", "functionparameters" "a\ int=1", "query" " | measure count() by computer | take a", "version" 1 } } } ] output parameters status code (number) reason (string) json body (object) id (string) etag (string) properties (object) category (string) displayname (string) functionalias (string) functionparameters (string) query (string) version (number) response headers header type cache control string pragma string content type string expires string x ms failure cause string x ms request id string x ms correlation request id string x ms routing request id string strict transport security string x content type options string date string content length string