Include workspace name in query output

[StephenMorrison]

Is there a way to systematically collect the workspace name and include it in the output of a log analytics query?

We are working on an event management project and the json output includes the workspaceID but not the name.  Our CMDB currently doesn't populate the workspaceID. I am looking for a way to map the triggered alerts to a support group without having to hardcode mappings.  

I was hoping I could use something like extend WS = workspace('uid').Name to add this data in.

[#2 · Accepted solution]

Hi,

There is no such option available as far as I know. If you manage your configuration as code you can potentially when deploying every query/alert that you have to put statically the name of the workspace with something like

| extend workspaceName = 'Workspace1'

Mark this reply as answer if it provides some answer to your question.

[#3]

Thanks, for confirming. Looks like we are going to be modifying our servicenow discovery to include workspaceID so we have some way to correlate these events to an object in our CMDB

[#4]

@StephenMorrison 

Maybe you can use this:

Usage
| where TimeGenerated > ago(1h)
| summarize arg_max(ResourceUri,*) by TimeGenerated
| extend dynamicuri = split(ResourceUri,"/")
| extend workspacename = dynamicuri.[-1]
| project workspacename