Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

(KQL) calling a workspace() using a variable

Brass Contributor

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:

let var_j="ABCD";

workspace(var_j).WhateverTable

 

Of course, it works if I do:

workspace("BCD").WhateverTable

 

Could any of you help me?

7 Replies

@jjsantanna We can do a cross workspace querying by using workspace name and union KQL statements.  Something like this below,

 

workspace('<<your workspacename>>').tablename
union workspace(''<<your workspacename>>').tablename
where CategoryValue = 'Administrative'
 
If you would like to understand more details, pls refer this link: What’s New: Cross-workspace Analytics Rules - Microsoft Tech Community
 
Hope it helps.

Hi @printscreen, you didn't understand my question.

 

I just want to put the name of a log analytics workspace in a variable ("X") and call this variable (not the string) from the workspace() function. For example:

 

let X = loganalytics_workspacename;

workspace(X).<whatevertable>

 

*I'm writing some automated report and I would like to iterate over the loganalytics workspaces that we manage.

 

 

@jjsantanna Apologies, I got it wrong then, is this something below which you are looking at, does this helps?

 

let x = union workspace('workspacename1').AzureActivity;
let y = union workspace('workspacename2').SecurityEvent;
x
project timespan(8d)
NOT YET my dear @printscreen. But thanks so far for your willingness .
Using your example I want the following:

let x = 'workspacename1';
workspace(x).AzureActivity
Good afternoon, @jjsantanna.

Did you have any help with this point? I am experiencing the same problem but I am not succeeding. I declare the value of the workspace in a variable and pass the variable in the expression workspace(var_).Syslog, however, it is not working.

Got an answer with that?
No. This specific issue was not solved!
Any success yet? :)