Forum Discussion

Luizao_f's avatar
Luizao_f
Brass Contributor
Aug 27, 2021

(KQL) calling a workspace() using a variable for cross-workspace query

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:

 

let work_id="xyz";

workspace(work_id).Syslog

 

I declare the workspace value in a variable and pass the variable in the parameter in the expression, but it's not working. 😞 Does the workspace("") expression only accept passing the direct value in the expression, does it not accept a variable containing the string value?

 

That's how it works, workspace("xyz").Syslog, but I need to pass the value through a variable to a programming process I'm developing.

  • Hi,
    Is it possible for you to share a bit more about the process you are trying to solve? I was thinking if you can set the workspace ID before you send the query to the workspace.
    • Luizao_f's avatar
      Luizao_f
      Brass Contributor

      Good afternoon, @Anders.
      Below is the data filled in the table.
      In the example below, I pass the workspace id inside the workspace() expression to consult the cross logs of the syslog table and I have the expected results, as shown in the image.

      "Query"
      workspace("id_workspace").Syslog
      | where TimeGenerated >= ago(10m)

      But when I declare the same id in a variable and pass the variable in the workspace expression, it reports an error.
      "Query"
      let var_wor = "id_workspace";
      workspace(var_wor).Syslog
      | where TimeGenerated >= ago(10m)

      I found it strange, since it's the same string, what I'm doing is just passing it as a variable.
      I need this feature because I'm designing the structure via Azure Lighthouse and I'm going to use variable to store the values of the workspaces.

Resources