Forum Discussion
Single pane of glass for multiple log analytics workspaces?
If the data needs to reside in the original workspace (maybe for compliance reasons or to reduce egress) then maybe you can visualize the workspaces with an Azure Workbook. If it can be moved centrally, moving to a single workspace model ( or two to allow for a test/dev one of course) then that would help . Or as you say you can dual-home Windows data (at a cost).
You can also attach a Playbook to all incidents and therefore get a Teams, Email or ITSM message (or others) when you have an incident - regardless of the workspace, your central team can react to those.
Example Workbook (showing SecurityAlert data), essentially these can show cross-workspace queries or with Azure Lighthouse cross AAD workspaces. This shows two workspacesCode sample (which the above are based on)
SecurityAlert | summarize count() by AlertName, ProductName, AlertSeverity, ["Workspace"] = TenantId | order by Workspace asc, count_ desc
If the data needs to reside in the original workspace (maybe for compliance reasons or to reduce egress) then maybe you can visualize the workspaces with an Azure Workbook. If it can be moved centrally, moving to a single workspace model ( or two to allow for a test/dev one of course) then that would help . Or as you say you can dual-home Windows data (at a cost).
You can also attach a Playbook to all incidents and therefore get a Teams, Email or ITSM message (or others) when you have an incident - regardless of the workspace, your central team can react to those.
Example Workbook (showing SecurityAlert data), essentially these can show cross-workspace queries or with Azure Lighthouse cross AAD workspaces. This shows two workspaces
Code sample (which the above are based on)
SecurityAlert
| summarize count() by AlertName, ProductName, AlertSeverity, ["Workspace"] = TenantId
| order by Workspace asc, count_ desc
Thanks CliveWatson.
We're planning a rework of our subscription structure, such that we have a single workspace now, rather than one (or more) in each subscription and will use the appropriate RBAC control. It's going to be annoying to have to leave data in the existing workspaces to age and expire rather than to be able to munge it all into a single workspace but needs must...
