(KQL) calling a workspace() using a variable for cross-workspace query

%3CLINGO-SUB%20id%3D%22lingo-sub-2693869%22%20slang%3D%22en-US%22%3E(KQL)%20calling%20a%20workspace()%20using%20a%20variable%20for%20cross-workspace%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2693869%22%20slang%3D%22en-US%22%3E%3CP%3EDear%2C%20I%20need%2Fwant%20to%20call%20a%20(cross)%20LogAnalytics%20workspace%20using%20a%20variable.%20Something%20like%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20work_id%3D%22xyz%22%3B%3C%2FP%3E%3CP%3Eworkspace(work_id).Syslog%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20declare%20the%20workspace%20value%20in%20a%20variable%20and%20pass%20the%20variable%20in%20the%20parameter%20in%20the%20expression%2C%20but%20it's%20not%20working.%20%3A(%3C%2Fimg%3E%20Does%20the%20workspace(%22%22)%20expression%20only%20accept%20passing%20the%20direct%20value%20in%20the%20expression%2C%20does%20it%20not%20accept%20a%20variable%20containing%20the%20string%20value%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThat's%20how%20it%20works%2C%20workspace(%22xyz%22).Syslog%2C%20but%20I%20need%20to%20pass%20the%20value%20through%20a%20variable%20to%20a%20programming%20process%20I'm%20developing.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2703902%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%20for%20cross-workspace%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2703902%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EIs%20it%20possible%20for%20you%20to%20share%20a%20bit%20more%20about%20the%20process%20you%20are%20trying%20to%20solve%3F%20I%20was%20thinking%20if%20you%20can%20set%20the%20workspace%20ID%20before%20you%20send%20the%20query%20to%20the%20workspace.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2705210%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%20for%20cross-workspace%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2705210%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20afternoon%2C%20%40Anders.%3CBR%20%2F%3EBelow%20is%20the%20data%20filled%20in%20the%20table.%3CBR%20%2F%3EIn%20the%20example%20below%2C%20I%20pass%20the%20workspace%20id%20inside%20the%20workspace()%20expression%20to%20consult%20the%20cross%20logs%20of%20the%20syslog%20table%20and%20I%20have%20the%20expected%20results%2C%20as%20shown%20in%20the%20image.%3CBR%20%2F%3E%3CBR%20%2F%3E%22Query%22%3CBR%20%2F%3Eworkspace(%22id_workspace%22).Syslog%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(10m)%3CBR%20%2F%3E%3CBR%20%2F%3EBut%20when%20I%20declare%20the%20same%20id%20in%20a%20variable%20and%20pass%20the%20variable%20in%20the%20workspace%20expression%2C%20it%20reports%20an%20error.%3CBR%20%2F%3E%22Query%22%3CBR%20%2F%3Elet%20var_wor%20%3D%20%22id_workspace%22%3B%3CBR%20%2F%3Eworkspace(var_wor).Syslog%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(10m)%3CBR%20%2F%3E%3CBR%20%2F%3EI%20found%20it%20strange%2C%20since%20it's%20the%20same%20string%2C%20what%20I'm%20doing%20is%20just%20passing%20it%20as%20a%20variable.%3CBR%20%2F%3EI%20need%20this%20feature%20because%20I'm%20designing%20the%20structure%20via%20Azure%20Lighthouse%20and%20I'm%20going%20to%20use%20variable%20to%20store%20the%20values%20of%20the%20workspaces.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:

 

let work_id="xyz";

workspace(work_id).Syslog

 

I declare the workspace value in a variable and pass the variable in the parameter in the expression, but it's not working. :( Does the workspace("") expression only accept passing the direct value in the expression, does it not accept a variable containing the string value?

 

That's how it works, workspace("xyz").Syslog, but I need to pass the value through a variable to a programming process I'm developing.

2 Replies
Hi,
Is it possible for you to share a bit more about the process you are trying to solve? I was thinking if you can set the workspace ID before you send the query to the workspace.

Good afternoon, @Anders.
Below is the data filled in the table.
In the example below, I pass the workspace id inside the workspace() expression to consult the cross logs of the syslog table and I have the expected results, as shown in the image.

"Query"
workspace("id_workspace").Syslog
| where TimeGenerated >= ago(10m)

But when I declare the same id in a variable and pass the variable in the workspace expression, it reports an error.
"Query"
let var_wor = "id_workspace";
workspace(var_wor).Syslog
| where TimeGenerated >= ago(10m)

I found it strange, since it's the same string, what I'm doing is just passing it as a variable.
I need this feature because I'm designing the structure via Azure Lighthouse and I'm going to use variable to store the values of the workspaces.