I prefer one, mainly so all correlation happens in a single workspace and I have less resources to manage (RBAC, retention, Archive etc...).
Also for cost, one workspace with more data will get you to a Capacity Reservation tier quicker (e.g. 2 workspaces at 50GB, will be PAYG, 1 workspace at 100GB using 100GB reservation will be 50% cheaper).