All Apps and Add-ons

Microsoft OMS TA - Any plans to update to the API version?

maciep
Champion

Hi @jkat54,

We've been tasked with ingesting some data from OMS. We got the add-on installed and configured. It seems to work well. But it looks like it may be hitting an older version of the API?

For example, in the portal my query might look like this:

Perf | where Computer="azure_server1" | summarize max(CounterValue) by CounterName

But for this add-on, I think I have to use an older version of the query, something like:

Type=Perf Computer="azure_server1" | measure max(CounterValue) by CounterName

I'm new to log analytics in Azure, so maybe it's a different thing instead of a different version? I think we can get by with the older language, but thought i'd ask if any plans to update.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

@maciep

Here’s a post on the update

https://answers.splunk.com/answers/679888/log-analytics-oms-api-updated-new-working-code-in.html#ans...

New app on the horizon and working code in the post.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

@maciep

Here’s a post on the update

https://answers.splunk.com/answers/679888/log-analytics-oms-api-updated-new-working-code-in.html#ans...

New app on the horizon and working code in the post.

jkat54
SplunkTrust
SplunkTrust

Hey @maciep,

I've actually have 0 experience with OMS queries. I pulled this code from a docs.microsoft.com post that I cant find anymore (it literally disappeared in the last 3 days) . It was for authenticating and running the query. I wrapped that up into a modular input app with a delta mechanism. There is a section of the code that mentions the api version. I remember investigating that to see if there was a newer version. I tried several other api versions that i found in reference materials and they all failed except for that old one.

If you want to try a different API, check out bin/oms_inputs.py in the app. Look for this comment on or near line 149: " # URLs for retrieving data". There you can change uri_api = 'api-version=2017-04-26-preview' to whatever you want to test. I cant guarantee the newer api version wouldnt require additional changes to the code though.

0 Karma

maciep
Champion

Thanks for the reply, I'll take a look. I think our MS resource said he might be able to update the code as well. If we're successful, I'll follow up here.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I’ve started coding the ability to use both the direct api (api.loganalytics.io) and the azure api (management.azure.com). Also giving the option to change the API version...

It’s a fairly complicated change so I’m not sure when I’ll have t ready. Would you be interested in helping to beta test it?

0 Karma

maciep
Champion

yep, i can help beta test it...thanks!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...