(KQL) calling a workspace() using a variable

%3CLINGO-SUB%20id%3D%22lingo-sub-2108023%22%20slang%3D%22en-US%22%3E(KQL)%20calling%20a%20workspace()%20using%20a%20variable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2108023%22%20slang%3D%22en-US%22%3E%3CP%3EDear%2C%20I%20need%2Fwant%20to%20call%20a%20(cross)%20LogAnalytics%20workspace%20using%20a%20variable.%20Something%20like%20the%20following%3A%3C%2FP%3E%3CP%3Elet%20var_j%3D%22ABCD%22%3B%3C%2FP%3E%3CP%3Eworkspace(var_j).WhateverTable%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOf%20course%2C%20it%20works%20if%20I%20do%3A%3C%2FP%3E%3CP%3Eworkspace(%22BCD%22).WhateverTable%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECould%20any%20of%20you%20help%20me%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114077%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114077%22%20slang%3D%22en-US%22%3ENOT%20YET%20my%20dear%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F923986%22%20target%3D%22_blank%22%3E%40printscreen%3C%2FA%3E.%20But%20thanks%20so%20far%20for%20your%20willingness%20.%3CBR%20%2F%3EUsing%20your%20example%20I%20want%20the%20following%3A%3CBR%20%2F%3E%3CBR%20%2F%3Elet%20x%20%3D%20'workspacename1'%3B%3CBR%20%2F%3Eworkspace(x).AzureActivity%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114074%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114074%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F584375%22%20target%3D%22_blank%22%3E%40jjsantanna%3C%2FA%3E%26nbsp%3BApologies%2C%20I%20got%20it%20wrong%20then%2C%20is%20this%20something%20below%20which%20you%20are%20looking%20at%2C%20does%20this%20helps%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3Elet%26nbsp%3Bx%26nbsp%3B%3D%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eunion%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Bworkspace(%3C%2FSPAN%3E%3CSPAN%3E'workspacename1'%3C%2FSPAN%3E%3CSPAN%3E).AzureActivity%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Elet%26nbsp%3By%26nbsp%3B%3D%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eunion%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Bworkspace(%3C%2FSPAN%3E%3CSPAN%3E'workspacename2'%3C%2FSPAN%3E%3CSPAN%3E).SecurityEvent%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Ex%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Btimespan(%3C%2FSPAN%3E%3CSPAN%3E8%3C%2FSPAN%3E%3CSPAN%3Ed)%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114033%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114033%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F923986%22%20target%3D%22_blank%22%3E%40printscreen%3C%2FA%3E%2C%20you%20didn't%20understand%20my%20question.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20just%20want%20to%20put%20the%20name%20of%20a%20log%20analytics%20workspace%20in%20a%20variable%20(%22X%22)%20and%20call%20this%20variable%20(not%20the%20string)%20from%20the%20workspace()%20function.%20For%20example%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20X%20%3D%20loganalytics_workspacename%3B%3C%2FP%3E%3CP%3Eworkspace(X).%3CWHATEVERTABLE%3E%3C%2FWHATEVERTABLE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E*I'm%20writing%20some%20automated%20report%20and%20I%20would%20like%20to%20iterate%20over%20the%20loganalytics%20workspaces%20that%20we%20manage.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114028%22%20slang%3D%22en-US%22%3ERe%3A%20(KQL)%20calling%20a%20workspace()%20using%20a%20variable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114028%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F584375%22%20target%3D%22_blank%22%3E%40jjsantanna%3C%2FA%3E%26nbsp%3BWe%20can%20do%20a%20cross%20workspace%20querying%20by%20using%20workspace%20name%20and%20union%20KQL%20statements.%26nbsp%3B%20Something%20like%20this%20below%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3Eworkspace(%3C%2FSPAN%3E%3CSPAN%3E'%26lt%3B%3CYOUR%20workspacename%3D%22%22%3E%26gt%3B'%3C%2FYOUR%3E%3C%2FSPAN%3E%3CSPAN%3E).tablename%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eunion%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Bworkspace(%3C%2FSPAN%3E%3CSPAN%3E''%26lt%3B%3CYOUR%20workspacename%3D%22%22%3E%26gt%3B'%3C%2FYOUR%3E%3C%2FSPAN%3E%3CSPAN%3E).tablename%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3BCategoryValue%26nbsp%3B%3D%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E'Administrative'%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EIf%20you%20would%20like%20to%20understand%20more%20details%2C%20pls%20refer%20this%20link%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fwhat-s-new-cross-workspace-analytics-rules%2Fba-p%2F1664211%22%20target%3D%22_blank%22%3EWhat%E2%80%99s%20New%3A%20Cross-workspace%20Analytics%20Rules%20-%20Microsoft%20Tech%20Community%3C%2FA%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EHope%20it%20helps.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Contributor

Dear, I need/want to call a (cross) LogAnalytics workspace using a variable. Something like the following:

let var_j="ABCD";

workspace(var_j).WhateverTable

 

Of course, it works if I do:

workspace("BCD").WhateverTable

 

Could any of you help me?

4 Replies

@jjsantanna We can do a cross workspace querying by using workspace name and union KQL statements.  Something like this below,

 

workspace('<<your workspacename>>').tablename
union workspace(''<<your workspacename>>').tablename
where CategoryValue = 'Administrative'
 
If you would like to understand more details, pls refer this link: What’s New: Cross-workspace Analytics Rules - Microsoft Tech Community
 
Hope it helps.

Hi @printscreen, you didn't understand my question.

 

I just want to put the name of a log analytics workspace in a variable ("X") and call this variable (not the string) from the workspace() function. For example:

 

let X = loganalytics_workspacename;

workspace(X).<whatevertable>

 

*I'm writing some automated report and I would like to iterate over the loganalytics workspaces that we manage.

 

 

@jjsantanna Apologies, I got it wrong then, is this something below which you are looking at, does this helps?

 

let x = union workspace('workspacename1').AzureActivity;
let y = union workspace('workspacename2').SecurityEvent;
x
project timespan(8d)
NOT YET my dear @printscreen. But thanks so far for your willingness .
Using your example I want the following:

let x = 'workspacename1';
workspace(x).AzureActivity