(KQL) calling a workspace() using a variable for cross-workspace query

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following: let work_id="xyz"; workspace(work_id).Syslog I declare the workspace value in a var...

azure monitor

Anders Bengtsson

Former Employee

Aug 31, 2021

Hi,
Is it possible for you to share a bit more about the process you are trying to solve? I was thinking if you can set the workspace ID before you send the query to the workspace.

Luizao_f

Brass Contributor

Aug 31, 2021

Good afternoon, @Anders.
Below is the data filled in the table.
In the example below, I pass the workspace id inside the workspace() expression to consult the cross logs of the syslog table and I have the expected results, as shown in the image.

"Query"
workspace("id_workspace").Syslog
| where TimeGenerated >= ago(10m)

But when I declare the same id in a variable and pass the variable in the workspace expression, it reports an error.
"Query"
let var_wor = "id_workspace";
workspace(var_wor).Syslog
| where TimeGenerated >= ago(10m)

I found it strange, since it's the same string, what I'm doing is just passing it as a variable.
I need this feature because I'm designing the structure via Azure Lighthouse and I'm going to use variable to store the values of the workspaces.

Forum Discussion

(KQL) calling a workspace() using a variable for cross-workspace query