Forum Discussion
Sentinel query KQL with variables
Hello! I need to use variables as parameters of functions in Sentinel Logs. I have: let t = "Syslog"; let name = "my-Sentinel"; let id = "abc123"; Well, if do this, it works fine: ...
I've confirmed in testing the same as what you're experiencing.
Reviewing the documentation for cross workspace queries it's listed as a known limitation unfortunately:
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cross-workspace-query#limitations
- Cross-resource and cross-service queries don’t support parameterized functions