Getting Logs data across different components/ name

%3CLINGO-SUB%20id%3D%22lingo-sub-675039%22%20slang%3D%22en-US%22%3EGetting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-675039%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20two%20Log%20Analytics%26nbsp%3B%20Workspace%3C%2FP%3E%3CP%3Eand%20under%20this%20workspace%20%2C%20we%20have%20two%20names%20eastusprodanalytics%20and%20westusprodanalytics%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhich%20query%20should%20i%20use%20to%20union%20data%20across%20two%20names%20at%20category%20level%20logs%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-675039%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-675965%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-675965%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F355957%22%20target%3D%22_blank%22%3E%40vishalkakkar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20show%20how%20to%20get%20the%20EVENTS%20table%20from%20two%20workspaces.%3C%2FP%3E%0A%3CPRE%3Eunion%20withsource%20%3D%20SourceApp%0Aworkspace('eastusprodanalytics').Event%2C%20%20%0Aworkspace('westusprodanalytics-IT').Event%20%0A%7C%20parse%20SourceApp%20with%20*%20%22('%22%20applicationName%20%22')%22%20*%20%20%0A%2F%2F%20add%20query%20here%20%3C%2FPRE%3E%0A%3CP%3EYou%20could%20add%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eunion%20withsource%20%3D%20SourceApp%0Aworkspace('Fabrikamltdprod').SecurityEvent%2C%20%20%0Aworkspace('contosoretail-IT').SecurityEvent%20%0A%7C%20parse%20SourceApp%20with%20*%20%22('%22%20applicationName%20%22')%22%20*%20%20%0A%7C%20summarize%20count()%20by%20applicationName%2C%20EventID%20%3C%2FPRE%3E%0A%3CP%3EYou%20could%20also%20SAVE%20the%20first%20example%20as%20a%20Function%20to%20call%20in%20other%20queries%3CBR%20%2F%3E%3CBR%20%2F%3EFor%20more%20see%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUnion%20within%20a%20%3CEM%3Eworkspace%3C%2FEM%3E%20is%20here%3A%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Funionoperator%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Funionoperator%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-676008%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-676008%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20mistakenly%20put%20as%20workspace.%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20two%20resources%20Under%20LogAnalytics%20workspace%20group.%20and%20under%20those%20two%20resources%2C%20there%20are%20two%20names%20.%20For%20eg%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ELog%20Analytics%20workspaces%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%26nbsp%3B-%26gt%3B%26nbsp%3BName%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20Type%3CBR%20%2F%3Eeastusprodloganlytics%20eastus-prod-rg%3CBR%20%2F%3Ewestusprodloganlytics%20west-prod-rg%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIs%20there%20a%20way%20to%20union%20till%20name%20and%20type%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-676470%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-676470%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F355957%22%20target%3D%22_blank%22%3E%40vishalkakkar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAre%20you%20really%20asking%20for%20a%20Union%3F%26nbsp%3B%20This%20will%20Union%20the%20Table%20called%20%3CSTRONG%3EEvent%3C%2FSTRONG%3E%20with%20the%20Table%20called%20%3CSTRONG%3ESecurityEvent%3C%2FSTRONG%3E%20(using%2010%20records%20from%20each)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eunion%20isfuzzy%3Dtrue%0A(Event%20%7C%20limit%2010)%2C%20%0A(SecurityEvent%20%7C%20limit%2010)%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20is%20a%20great%20question%20to%20ask%2C%20if%20you%20supply%20the%20data%20in%20a%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fdatatableoperator%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSTRONG%3Edatatable%3C%2FSTRONG%3E%3C%2FA%3E%3A%2C%20are%20you%20trying%20to%20concatenate%20the%20two%20values%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Elet%20dummyData%20%3D%20datatable(Name%3Astring%2C%20Type%3Astring)%0A%5B%0A%20%20%20%20%22eastusprodloganlytics%22%20%2C%20%22eastus-prod-rg%22%20%2C%0A%20%20%20%20%22westusprodloganlytics%22%20%2C%20%22west-prod-rg%22%20%0A%5D%3B%0AdummyData%0A%7C%20where%20Name%20!%3D%22%22%0A%7C%20project%20theMergedStringIs%20%3D%20strcat(Name%2C%20%22%20%22%20%2C%20Type)%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20448px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F117407i60501CDA48D32DFF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-06-06%20235623.jpg%22%20title%3D%22Annotation%202019-06-06%20235623.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20this%20isn't%20right%2C%20can%20you%20share%20a%20screenshot%2C%20as%20its%20hard%20to%20tell%20what%20your%20data%20looks%20like%20and%20what%20you%20want%20it%20to%20change%20to%3F%26nbsp%3B%20e.g.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20510px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F117410i3DD0D9DFFD9FC86E%2Fimage-dimensions%2F510x321%3Fv%3D1.0%22%20width%3D%22510%22%20height%3D%22321%22%20alt%3D%22Annotation%202019-06-07%20000210.jpg%22%20title%3D%22Annotation%202019-06-07%20000210.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20Clive%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-681017%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-681017%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20find%20below%20screenshot%2C%20am%20tying%20to%20concatenate%20logs%20from%20two%20different%20workspaces.%3C%2FP%3E%3CP%3ESo%20there%20is%20one%20more%20workspace%20which%20i%20need%20to%20add%20to%20concetenate%20logs%20from%20two%20different%20workspace%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-VIshal%20Kakkar%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-681018%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-681018%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20find%20below%20screenshot%2C%20am%20tying%20to%20concatenate%20logs%20from%20two%20different%20workspaces.%3C%2FP%3E%3CP%3ESo%20there%20is%20one%20more%20workspace%20which%20i%20need%20to%20add%20to%20concetenate%20logs%20from%20two%20different%20workspace%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-VIshal%20Kakkar%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-681059%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20Logs%20data%20across%20different%20components%2F%20name%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-681059%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F355957%22%20target%3D%22_blank%22%3E%40vishalkakkar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20to%20merge%20two%20workspaces%20(or%20more)%20in%20single%20query%20we%20can%20UNION%20them.%26nbsp%3B%20You%20will%20have%20to%20amend%20the%20code%20to%20put%20in%20your%20names%20lines%204%20%26amp%3B%205%20and%20change%20the%20%3CEM%3Eorignalhost_s%3C%2FEM%3E%20line%20to%20match%20your%20setup.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eunion%20withsource%20%3D%20SourceApp%0A%2F%2Fworkspace('eastusprodanalytics'%20%20%20).AzureDiagnostics%2C%20%20%0A%2F%2Fworkspace('westusprodanalytics-IT').AzureDiagnostics%2C%20%0Aworkspace('ContosoRetail-IT').AzureDiagnostics%2C%20%0Aworkspace('Fabrikamltdprod'%20).AzureDiagnostics%20%0A%7C%20parse%20SourceApp%20with%20*%20%22('%22%20applicationName%20%22')%22%20*%20%20%0A%7C%20where%20Category%20%3D%3D%20%22ApplicationGatewayAccessLog%22%20%0A%7C%20where%20originalHost_s%20%3D%3D%20%2213.85.25.40%22%0A%7C%20summarize%20count()%20by%20bin(TimeGenerated%2C%201h)%20%2C%20applicationName%0A%7C%20sort%20by%20count_%20desc%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ethe%20output%20looks%20like%20this%20(only%20one%20of%20my%20workspaces%20had%20these%20entries)%20-%20so%20only%20one%20is%20shown%20in%20the%20%22applicationname%22%20column.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3ETimeGenerated%3C%2FTH%3E%0A%3CTH%3EapplicationName%3C%2FTH%3E%0A%3CTH%3Ecount_%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T09%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E1525%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T07%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E1424%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-08T21%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E520%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T06%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E295%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T00%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E269%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T11%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E220%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T12%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E216%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T10%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E216%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E80%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T20%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E58%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E58%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E54%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-08T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E52%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T17%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E50%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E50%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T16%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E20%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T01%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E16%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T08%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E16%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T06%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E16%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T05%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E14%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T02%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E10%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T03%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E8%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-03T21%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E5%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T03%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E4%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T06%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E4%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-03T19%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E3%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T14%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T23%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-06T13%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T14%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T13%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T09%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T18%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T15%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T15%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T13%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-03T18%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T22%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T17%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-10T00%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T08%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T23%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-05T01%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T13%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-04T01%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T04%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-09T23%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E2019-06-07T05%3A00%3A00Z%3C%2FTD%3E%0A%3CTD%3EContosoRetail-IT%3C%2FTD%3E%0A%3CTD%3E2%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We have two Log Analytics  Workspace

and under this workspace , we have two names eastusprodanalytics and westusprodanalytics

 

Which query should i use to union data across two names at category level logs

6 Replies

@vishalkakkar 

This show how to get the EVENTS table from two workspaces.

union withsource = SourceApp
workspace('eastusprodanalytics').Event,  
workspace('westusprodanalytics-IT').Event 
| parse SourceApp with * "('" applicationName "')" *  
// add query here 

You could add:

 

union withsource = SourceApp
workspace('Fabrikamltdprod').SecurityEvent,  
workspace('contosoretail-IT').SecurityEvent 
| parse SourceApp with * "('" applicationName "')" *  
| summarize count() by applicationName, EventID 

You could also SAVE the first example as a Function to call in other queries

For more see: https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query

 

Union within a workspace is here:  https://docs.microsoft.com/en-us/azure/kusto/query/unionoperator

 

 

 

 

Thanks @Clive Watson 

 

I mistakenly put as workspace. 

I have two resources Under LogAnalytics workspace group. and under those two resources, there are two names . For eg:

 

Log Analytics workspaces 

 -> Name                      Type
eastusprodloganlytics eastus-prod-rg
westusprodloganlytics west-prod-rg

 

Is there a way to union till name and type

@vishalkakkar 

 

Are you really asking for a Union?  This will Union the Table called Event with the Table called SecurityEvent (using 10 records from each)

 

 

union isfuzzy=true
(Event | limit 10), 
(SecurityEvent | limit 10)

 

This is a great question to ask, if you supply the data in a datatable:, are you trying to concatenate the two values?

 

 

let dummyData = datatable(Name:string, Type:string)
[
    "eastusprodloganlytics" , "eastus-prod-rg" ,
    "westusprodloganlytics" , "west-prod-rg" 
];
dummyData
| where Name !=""
| project theMergedStringIs = strcat(Name, " " , Type)

Annotation 2019-06-06 235623.jpg

 

If this isn't right, can you share a screenshot, as its hard to tell what your data looks like and what you want it to change to?  e.g.

 

Annotation 2019-06-07 000210.jpg

 

Thanks Clive

 

 

 

@Clive Watson 

 

Please find below screenshot, am tying to concatenate logs from two different workspaces.

So there is one more workspace which i need to add to concetenate logs from two different workspace

 

-VIshal Kakkar

 

 

@Clive Watson 

 

Please find below screenshot, am tying to concatenate logs from two different workspaces.

So there is one more workspace which i need to add to concetenate logs from two different workspace

 

-VIshal Kakkar

 

 

Hello @vishalkakkar 

 

So to merge two workspaces (or more) in single query we can UNION them.  You will have to amend the code to put in your names lines 4 & 5 and change the orignalhost_s line to match your setup. 

 

union withsource = SourceApp
//workspace('eastusprodanalytics'   ).AzureDiagnostics,  
//workspace('westusprodanalytics-IT').AzureDiagnostics, 
workspace('ContosoRetail-IT').AzureDiagnostics, 
workspace('Fabrikamltdprod' ).AzureDiagnostics 
| parse SourceApp with * "('" applicationName "')" *  
| where Category == "ApplicationGatewayAccessLog" 
| where originalHost_s == "13.85.25.40"
| summarize count() by bin(TimeGenerated, 1h) , applicationName
| sort by count_ desc

 

the output looks like this (only one of my workspaces had these entries) - so only one is shown in the "applicationname" column.

 

TimeGenerated applicationName count_
2019-06-04T09:00:00Z ContosoRetail-IT 1525
2019-06-07T07:00:00Z ContosoRetail-IT 1424
2019-06-08T21:00:00Z ContosoRetail-IT 520
2019-06-09T06:00:00Z ContosoRetail-IT 295
2019-06-06T00:00:00Z ContosoRetail-IT 269
2019-06-05T11:00:00Z ContosoRetail-IT 220
2019-06-05T12:00:00Z ContosoRetail-IT 216
2019-06-05T10:00:00Z ContosoRetail-IT 216
2019-06-09T16:00:00Z ContosoRetail-IT 80
2019-06-04T20:00:00Z ContosoRetail-IT 58
2019-06-07T16:00:00Z ContosoRetail-IT 58
2019-06-10T16:00:00Z ContosoRetail-IT 54
2019-06-08T16:00:00Z ContosoRetail-IT 52
2019-06-06T17:00:00Z ContosoRetail-IT 50
2019-06-05T16:00:00Z ContosoRetail-IT 50
2019-06-04T16:00:00Z ContosoRetail-IT 20
2019-06-07T01:00:00Z ContosoRetail-IT 16
2019-06-07T08:00:00Z ContosoRetail-IT 16
2019-06-10T06:00:00Z ContosoRetail-IT 16
2019-06-09T05:00:00Z ContosoRetail-IT 14
2019-06-04T02:00:00Z ContosoRetail-IT 10
2019-06-05T03:00:00Z ContosoRetail-IT 8
2019-06-03T21:00:00Z ContosoRetail-IT 5
2019-06-06T03:00:00Z ContosoRetail-IT 4
2019-06-07T06:00:00Z ContosoRetail-IT 4
2019-06-03T19:00:00Z ContosoRetail-IT 3
2019-06-06T14:00:00Z ContosoRetail-IT 2
2019-06-06T23:00:00Z ContosoRetail-IT 2
2019-06-06T13:00:00Z ContosoRetail-IT 2
2019-06-10T14:00:00Z ContosoRetail-IT 2
2019-06-05T13:00:00Z ContosoRetail-IT 2
2019-06-10T09:00:00Z ContosoRetail-IT 2
2019-06-09T18:00:00Z ContosoRetail-IT 2
2019-06-09T15:00:00Z ContosoRetail-IT 2
2019-06-04T15:00:00Z ContosoRetail-IT 2
2019-06-10T13:00:00Z ContosoRetail-IT 2
2019-06-03T18:00:00Z ContosoRetail-IT 2
2019-06-05T22:00:00Z ContosoRetail-IT 2
2019-06-04T17:00:00Z ContosoRetail-IT 2
2019-06-10T00:00:00Z ContosoRetail-IT 2
2019-06-05T08:00:00Z ContosoRetail-IT 2
2019-06-07T23:00:00Z ContosoRetail-IT 2
2019-06-05T01:00:00Z ContosoRetail-IT 2
2019-06-04T13:00:00Z ContosoRetail-IT 2
2019-06-04T01:00:00Z ContosoRetail-IT 2
2019-06-09T04:00:00Z ContosoRetail-IT 2
2019-06-09T23:00:00Z ContosoRetail-IT 2
2019-06-07T05:00:00Z ContosoRetail-IT 2