Forum Discussion

leo_szalk's avatar
leo_szalk
Copper Contributor
Dec 23, 2021

Cross Workspace Analytic Rule Functions

I'm trying to get some of the pre-built queries that use the aadFunc() to query into a different workspace. I've tried a number of methods and continuously get the error of:

  • "Expecting all arguments to be literals"
  • Basic example:
let aadFunc = (workspaceName:string, tableName:string){
workspace(workspaceName).table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').","SigninLogs");
let aadNonInt = aadFunc("workspace('a').","AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

 

I've also tried just setting the tableName parameter to the full "workspace('a').SigninLogs" as a string, and it also returned a similar errors:

  • "'where' operator: Failed to resolve table expression named '["workspace('a').SigninLogs"]'"
  • table(): argument #1 must be a non-empty string literal
  • Basic example:
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').SigninLogs");
let aadNonInt = aadFunc("workspace('a').AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

 

Any thoughts or suggestions on getting this to function properly?

1 Reply

  • Suhelajjaman's avatar
    Suhelajjaman
    Copper Contributor
    Hopefully this would help. Just assign tables reference in start of your query.

    let CrossWSTable1 =union workspace("a").SigninLogs;
    let CrossWSTable2 =union workspace("a").AADNonInteractiveUserSignInLogs;
    let aadFunc = (tableName:string){
    table(tableName)
    | where TimeGenerated >= ago(7d)
    };
    let aadSignin = aadFunc("CrossWSTable1");
    let aadNonInt = aadFunc("CrossWSTable2");
    union isfuzzy=true aadSignin, aadNonInt

Resources