Identify workspace after a Union

I'm executing a query with a union on the Heartbeat table of two work spaces. I'd like to have an additional column that identifies which work space the result is from. The query: union isfuzzy...

azure monitor

Query Language

CliveWatson
Feb 28, 2019
You can use, withsource, you might need to trim/parse the returned name as its in the format?

workspace : workspace('workspacea').Heartbeat

union withsource = workspace isfuzzy= true

workspace("a").Heartbeat,

workspace("b").Heartbeat

| project TimeGenerated , Computer, ResourceId , OSType, workspace

| where TimeGenerated < now()

| where ResourceId == ""

| where OSType == "Windows" or OSType == "Linux"

| summarize arg_max(TimeGenerated, *) by Computer, workspace

| distinct Computer, workspace