All Apps and Add-ons

Microsoft OMS TA - Any plans to update to the API version?

maciep
Champion

Hi @jkat54,

We've been tasked with ingesting some data from OMS. We got the add-on installed and configured. It seems to work well. But it looks like it may be hitting an older version of the API?

For example, in the portal my query might look like this:

Perf | where Computer="azure_server1" | summarize max(CounterValue) by CounterName

But for this add-on, I think I have to use an older version of the query, something like:

Type=Perf Computer="azure_server1" | measure max(CounterValue) by CounterName

I'm new to log analytics in Azure, so maybe it's a different thing instead of a different version? I think we can get by with the older language, but thought i'd ask if any plans to update.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

@maciep

Here’s a post on the update

https://answers.splunk.com/answers/679888/log-analytics-oms-api-updated-new-working-code-in.html#ans...

New app on the horizon and working code in the post.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

@maciep

Here’s a post on the update

https://answers.splunk.com/answers/679888/log-analytics-oms-api-updated-new-working-code-in.html#ans...

New app on the horizon and working code in the post.

jkat54
SplunkTrust
SplunkTrust

Hey @maciep,

I've actually have 0 experience with OMS queries. I pulled this code from a docs.microsoft.com post that I cant find anymore (it literally disappeared in the last 3 days) . It was for authenticating and running the query. I wrapped that up into a modular input app with a delta mechanism. There is a section of the code that mentions the api version. I remember investigating that to see if there was a newer version. I tried several other api versions that i found in reference materials and they all failed except for that old one.

If you want to try a different API, check out bin/oms_inputs.py in the app. Look for this comment on or near line 149: " # URLs for retrieving data". There you can change uri_api = 'api-version=2017-04-26-preview' to whatever you want to test. I cant guarantee the newer api version wouldnt require additional changes to the code though.

0 Karma

maciep
Champion

Thanks for the reply, I'll take a look. I think our MS resource said he might be able to update the code as well. If we're successful, I'll follow up here.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I’ve started coding the ability to use both the direct api (api.loganalytics.io) and the azure api (management.azure.com). Also giving the option to change the API version...

It’s a fairly complicated change so I’m not sure when I’ll have t ready. Would you be interested in helping to beta test it?

0 Karma

maciep
Champion

yep, i can help beta test it...thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...