It took us some time but we’ve managed to update the one and only free OMS book. We had plans to release it earlier but unforeseen things has happened which prevented us to do it earlier. I hope you will understand but you will still enjoy it. The other authors and me put a lot of effort to get it out along with the reviewers.
The new query language of Log Analytics is not included in the book but that should not discourage you as the content is still relevant.
Go grab Inside the Microsoft Operations Management Suite for free. Let us know if you have any feedback.
I mostly would like to thank my fiancée for being patient with me and supporting me while I was writing my chapters.
Great book! Thanks for sharing it for free 🙂
One question about Powershell usage in searching Log Analytics. Do you know about any limitations in using Skip command inside a query? I’m trying to grab quite large amount of Events but with Skip returns results only when incremented up to 50.000. No results over that value. Of course I can (and probably – will) decrease the time frames (start and end switches), but I wonder if you know about such limitation?
Thanks in advance for any reply.
Hi
Please have a look at the solution by one of the co-authors here:
http://blog.tyang.org/2017/04/25/programmatically-performing-oms-log-search-against-a-large-result-set/
When you are dealing with large amounts of data you would want to slice it any way possible in order to process it.
Thanks for such a quick reply.
I saw this site (frankly – went from this site to yours and to the ebook).
The method used there works ok, but only (at least for me) when the total result is less than 50.000. But that’s ok, I’ll add more filtering to it and the logic to process whole data. The question was just a kind of wondering if this 50.000 is known and hardcoded anywhere or if I’m doing anything wrong 🙂
By the way, when speaking about the methods used in Tao’s post – one thing that worked differently for me was the result’s metadata ‘Total’ value. It always returns the same value as declared by ‘Top’ attribute (of course, assuming ‘Top’ is less or equal 5000). In Tao’s script ‘Total’ value returned …. well, the total amount of result objects. I was trying several methods but always got the same results. I wonder if anything changed since April 2017.