Forum Discussion
(KQL) calling a workspace() using a variable
Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:
let var_j="ABCD";
workspace(var_j).WhateverTable
Of course, it works if I do:
workspace("BCD").WhateverTable
Could any of you help me?
- Any success yet? 🙂
jjsantanna We can do a cross workspace querying by using workspace name and union KQL statements. Something like this below,
workspace('<<your workspacename>>').tablename| union workspace(''<<your workspacename>>').tablename| where CategoryValue = 'Administrative'If you would like to understand more details, pls refer this link: What’s New: Cross-workspace Analytics Rules - Microsoft Tech CommunityHope it helps.Hi printscreen, you didn't understand my question.
I just want to put the name of a log analytics workspace in a variable ("X") and call this variable (not the string) from the workspace() function. For example:
let X = loganalytics_workspacename;
workspace(X).<whatevertable>
*I'm writing some automated report and I would like to iterate over the loganalytics workspaces that we manage.
jjsantanna Apologies, I got it wrong then, is this something below which you are looking at, does this helps?
let x = union workspace('workspacename1').AzureActivity;let y = union workspace('workspacename2').SecurityEvent;x| project timespan(8d)
