I am querying a list of workspace ids... some of those workspaces have the ServiceMap tables, and some don't.
search *
| where TimeGenerated > ago(4h) and $table == "VMComputer"
| distinct TenantId
| project WorkspaceId = TenantId
This returns me a list of workspace ids that have VMComputer, but because of the search * it takes like 5 seconds to run.
Can you suggest a faster way?
