query result limitations

Category: azure operational insights


napel25 on Wed, 27 Jan 2016 13:39:03


To manage servers located at several locations we are testing what OMS offers.

With the ARM interface in Powershell we query the event logs gathered in OMS.

But the results are not always consistent. When I use a query that contains a specific server name, I get more results on that server then when I query on all servers. When I query all servers the RawContentLength returns 188640. The last server in the list is the server with the missing events. But in the result of all servers I am also missing other servers that should be in the result.

Is it possible that the ARM query results are limited on the size (RawContentLength for example)?

Kind regards,



napel25 on Tue, 16 Feb 2016 13:04:33

It looks like the ARM interface only returns the first 10 rows from the OMS querying the events. It has probably nothing to do with the data size.

napel25 on Tue, 16 Feb 2016 14:24:09

Solved. In the body of the web request you can give parameters in json format. That contains a top parameter with a default of 10.

Powershell code:

$private:queryData = New-Object PSObject |
                    Add-Member -PassThru NoteProperty query $Query |
                    Add-Member -PassThru NoteProperty top 200