(KQL) calling a workspace() using a variable for cross-workspace query

%3CLINGO-SUB%20id%3D%22lingo-sub-2693869%22%20slang%3D%22en-US%22%3E(KQL)%20calling%20a%20workspace()%20using%20a%20variable%20for%20cross-workspace%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2693869%22%20slang%3D%22en-US%22%3E%3CP%3EDear%2C%20I%20need%2Fwant%20to%20call%20a%20(cross)%20LogAnalytics%20workspace%20using%20a%20variable.%20Something%20like%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20work_id%3D%22xyz%22%3B%3C%2FP%3E%3CP%3Eworkspace(work_id).Syslog%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20declare%20the%20workspace%20value%20in%20a%20variable%20and%20pass%20the%20variable%20in%20the%20parameter%20in%20the%20expression%2C%20but%20it's%20not%20working.%20%3A(%3C%2Fimg%3E%20Does%20the%20workspace(%22%22)%20expression%20only%20accept%20passing%20the%20direct%20value%20in%20the%20expression%2C%20does%20it%20not%20accept%20a%20variable%20containing%20the%20string%20value%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThat's%20how%20it%20works%2C%20workspace(%22xyz%22).Syslog%2C%20but%20I%20need%20to%20pass%20the%20value%20through%20a%20variable%20to%20a%20programming%20process%20I'm%20developing.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2703902%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%20for%20cross-workspace%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2703902%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EIs%20it%20possible%20for%20you%20to%20share%20a%20bit%20more%20about%20the%20process%20you%20are%20trying%20to%20solve%3F%20I%20was%20thinking%20if%20you%20can%20set%20the%20workspace%20ID%20before%20you%20send%20the%20query%20to%20the%20workspace.%3C%2FLINGO-BODY%3E
Contributor

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:

 

let work_id="xyz";

workspace(work_id).Syslog

 

I declare the workspace value in a variable and pass the variable in the parameter in the expression, but it's not working. :( Does the workspace("") expression only accept passing the direct value in the expression, does it not accept a variable containing the string value?

 

That's how it works, workspace("xyz").Syslog, but I need to pass the value through a variable to a programming process I'm developing.

2 Replies
Hi,
Is it possible for you to share a bit more about the process you are trying to solve? I was thinking if you can set the workspace ID before you send the query to the workspace.

Good afternoon, @Anders.
Below is the data filled in the table.
In the example below, I pass the workspace id inside the workspace() expression to consult the cross logs of the syslog table and I have the expected results, as shown in the image.

"Query"
workspace("id_workspace").Syslog
| where TimeGenerated >= ago(10m)

But when I declare the same id in a variable and pass the variable in the workspace expression, it reports an error.
"Query"
let var_wor = "id_workspace";
workspace(var_wor).Syslog
| where TimeGenerated >= ago(10m)

I found it strange, since it's the same string, what I'm doing is just passing it as a variable.
I need this feature because I'm designing the structure via Azure Lighthouse and I'm going to use variable to store the values of the workspaces.