Aug 27 2021
01:00 PM
- last edited on
Apr 08 2022
10:53 AM
by
TechCommunityAP
Aug 27 2021
01:00 PM
- last edited on
Apr 08 2022
10:53 AM
by
TechCommunityAP
Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:
let work_id="xyz";
workspace(work_id).Syslog
I declare the workspace value in a variable and pass the variable in the parameter in the expression, but it's not working. :( Does the workspace("") expression only accept passing the direct value in the expression, does it not accept a variable containing the string value?
That's how it works, workspace("xyz").Syslog, but I need to pass the value through a variable to a programming process I'm developing.
Aug 31 2021 10:33 AM
Aug 31 2021 05:33 PM - edited Aug 31 2021 05:35 PM
Good afternoon, @Anders.
Below is the data filled in the table.
In the example below, I pass the workspace id inside the workspace() expression to consult the cross logs of the syslog table and I have the expected results, as shown in the image.
"Query"
workspace("id_workspace").Syslog
| where TimeGenerated >= ago(10m)
But when I declare the same id in a variable and pass the variable in the workspace expression, it reports an error.
"Query"
let var_wor = "id_workspace";
workspace(var_wor).Syslog
| where TimeGenerated >= ago(10m)
I found it strange, since it's the same string, what I'm doing is just passing it as a variable.
I need this feature because I'm designing the structure via Azure Lighthouse and I'm going to use variable to store the values of the workspaces.