There is a command group 'az_monitor_log analytics'. This group of commands could 'commands for querying data in log analytics workspaces'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_monitor_log analytics_query'.The syntax is: az monitor log-analytics query --analytics-query
                               --workspace
                               [--timespan]
                               [--workspaces]. The 1th example of the child command would be to use it to 'execute a simple query over past 3 5 days', the syntax is: az monitor log-analytics query -w workspace-customId --analytics-query "AzureActivity | summarize count() by bin(timestamp, 1h)" -t P3DT12H. The 2th example of the child command would be to use it to 'execute a saved query in workspace', the syntax is: QUERY=$(az monitor log-analytics workspace saved-search show -g resource-group --workspace-name workspace-name -n query-name --query query --output tsv)
az monitor log-analytics query -w workspace-customId --analytics-query "$QUERY". The parameter '--analytics-query' is required. It is used to query to execute over log analytics data.. The parameter '--workspace -w' is required. It is used to guid of the log analytics workspace.. The parameter '--timespan -t' is optional. timespan over which to query. defaults to querying all available data.. The parameter '--workspaces' is optional. additional workspaces to union data for querying. specify additional workspace ids separated by space.. 