Forum Discussion
leo_szalk
Dec 23, 2021Copper Contributor
Cross Workspace Analytic Rule Functions
I'm trying to get some of the pre-built queries that use the aadFunc() to query into a different workspace. I've tried a number of methods and continuously get the error of: "Expecting all argument...
Suhelajjaman
Dec 26, 2021Copper Contributor
Hopefully this would help. Just assign tables reference in start of your query.
let CrossWSTable1 =union workspace("a").SigninLogs;
let CrossWSTable2 =union workspace("a").AADNonInteractiveUserSignInLogs;
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("CrossWSTable1");
let aadNonInt = aadFunc("CrossWSTable2");
union isfuzzy=true aadSignin, aadNonInt
let CrossWSTable1 =union workspace("a").SigninLogs;
let CrossWSTable2 =union workspace("a").AADNonInteractiveUserSignInLogs;
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("CrossWSTable1");
let aadNonInt = aadFunc("CrossWSTable2");
union isfuzzy=true aadSignin, aadNonInt