Nov 10 2019
06:24 AM
- last edited on
Apr 08 2022
10:12 AM
by
TechCommunityAP
Nov 10 2019
06:24 AM
- last edited on
Apr 08 2022
10:12 AM
by
TechCommunityAP
Nov 11 2019 11:25 PM
Nov 12 2019 02:30 AM
There's an example below on how to construct a query across multiple workspaces. As you said they are under the same tenant then copy the format below:
union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification
from the ms docs
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query
For the report part as the previous reply said, use function or logic app to trigger running the query at intervals, and use function+sendgrid or e-mail option in logicapp to mail it out.