LogAnalyticURLCreator.ps1

Function Encode-LogAnalyticsQuery{
<#
.SYNOPSIS
This function is used by the Write-LogAnalyticsURL Function to encode the query string for the URL.
    
.DESCRIPTION
This function outputs a compressed Base64 string based in the QueryString value passed to it.

.PARAMETER QueryString
The query you want to create a URL for.

.LINK
http://blogs.catapultsystems.com/mdowst/

#>
    param(
        [string]$QueryString
    )
    # convert string to byte array
    $enc = [system.Text.Encoding]::UTF8
    $data = $enc.GetBytes($queryString)

    # compress data
    $compressedStream = [System.IO.MemoryStream]::new()
    $zipStream = [System.IO.Compression.GZipStream]::new($compressedStream, [System.IO.Compression.CompressionMode]::Compress)
    $zipStream.Write($data, 0, $data.Length);
    $zipStream.Close();
    $compressedData = $compressedStream.ToArray()

    # encode the compressed data to Base64 string
    $EncodedText =[Convert]::ToBase64String($compressedData)

    # replace special characters with URL encoding references
    $EncodedText = $EncodedText.Replace('/','%2F')
    $EncodedText = $EncodedText.Replace('+','%2B')
    $EncodedText = $EncodedText.Replace('=','%3D')
    
    $EncodedText
}

Function Write-LogAnalyticsURL{
<#
.SYNOPSIS
This function is used create a Log Analytics URL with an embedded query
    
.DESCRIPTION
This function is used create a Log Analytics URL with an embedded query. This URL can be used to provide a link in custom alerting solutions, 
or it can be used to open the web browser directly on your local machine.

.PARAMETER SubscriptionId
The GUID of your Azure Subscription that contains the Log Analytics Workspace.

.PARAMETER ResourceGroup
The name of your Azure Resource Group that contains the Log Analytics Workspace.

.PARAMETER Workspace
The name of your Log Analytics Workspace.

.PARAMETER QueryString
The query you want to create a URL for.

.EXAMPLE
Creates a URL for the supplied query.

$QueryString = "Heartbeat | where TimeGenerated>ago(12h) and Computer==""$ComputerName"""

Write-LogAnalyticsURL -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -Workspace $Workspace -QueryString $QueryString

.EXAMPLE
Creates a URL for the supplied query and launches it using your default web browser.

$URL = Write-LogAnalyticsURL -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -Workspace $Workspace -QueryString $QueryString
[System.Diagnostics.Process]::Start($URL)

.NOTES
You can determine the values required for the SubscriptionId, ResourceGroup, and Workspace parameters by navigating to the workspace in 
the Azure Portal and copying the values from the Overview blade.

.LINK
http://blogs.catapultsystems.com/mdowst/

#>
    param(
	    [Parameter(Mandatory=$true)]
	    [Guid]$SubscriptionId,
	
	    [Parameter(Mandatory=$true)]
	    [string]$ResourceGroup,
	
	    [Parameter(Mandatory=$true)]
	    [string]$Workspace,
	
	    [Parameter(Mandatory=$true)]
	    [string]$QueryString
    )
    # Convert the query string to encoded text
    $EncodedText = Encode-LogAnalyticsQuery $queryString

    # build the full URL
    [string]$URLString = 'https://portal.azure.com/#blade/Microsoft_OperationsManagementSuite_Workspace/' + 
        'AnalyticsBlade/initiator/AnalyticsShareLinkToQuery/isQueryEditorVisible/true/scope/%7B%22resources%2' + 
        '2%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F{0}%2Fresourcegroups%2F{1}%2Fproviders%2Fmicrosoft' + 
        '.operationalinsights%2Fworkspaces%2F{2}%22%7D%5D%7D/query/{3}/isQueryBase64Compressed/true/timespanInIsoFormat/P1D'

    # input the environment variables and encoded query
    [string]$URL = $URLString -f $SubscriptionId, $ResourceGroup, $Workspace, $EncodedText

    Return $URL
}