Cross Workspace Analytic Rule Functions

Copper Contributor

I'm trying to get some of the pre-built queries that use the aadFunc() to query into a different workspace. I've tried a number of methods and continuously get the error of:

  • "Expecting all arguments to be literals"
  • Basic example:
let aadFunc = (workspaceName:string, tableName:string){
workspace(workspaceName).table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').","SigninLogs");
let aadNonInt = aadFunc("workspace('a').","AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

 

I've also tried just setting the tableName parameter to the full "workspace('a').SigninLogs" as a string, and it also returned a similar errors:

  • "'where' operator: Failed to resolve table expression named '["workspace('a').SigninLogs"]'"
  • table(): argument #1 must be a non-empty string literal
  • Basic example:
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').SigninLogs");
let aadNonInt = aadFunc("workspace('a').AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

 

Any thoughts or suggestions on getting this to function properly?

1 Reply
Hopefully this would help. Just assign tables reference in start of your query.

let CrossWSTable1 =union workspace("a").SigninLogs;
let CrossWSTable2 =union workspace("a").AADNonInteractiveUserSignInLogs;
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("CrossWSTable1");
let aadNonInt = aadFunc("CrossWSTable2");
union isfuzzy=true aadSignin, aadNonInt