Cross Workspace Analytic Rule Functions

[leo_szalk]

I'm trying to get some of the pre-built queries that use the aadFunc() to query into a different workspace. I've tried a number of methods and continuously get the error of:

• "Expecting all arguments to be literals"
• Basic example:

let aadFunc = (workspaceName:string, tableName:string){
workspace(workspaceName).table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').","SigninLogs");
let aadNonInt = aadFunc("workspace('a').","AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

I've also tried just setting the tableName parameter to the full "workspace('a').SigninLogs" as a string, and it also returned a similar errors:

• "'where' operator: Failed to resolve table expression named '["workspace('a').SigninLogs"]'"
• table(): argument #1 must be a non-empty string literal
• Basic example:

let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("workspace('a').SigninLogs");
let aadNonInt = aadFunc("workspace('a').AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

Any thoughts or suggestions on getting this to function properly?

[#2]

Hopefully this would help. Just assign tables reference in start of your query.

let CrossWSTable1 =union workspace("a").SigninLogs;
let CrossWSTable2 =union workspace("a").AADNonInteractiveUserSignInLogs;
let aadFunc = (tableName:string){
table(tableName)
| where TimeGenerated >= ago(7d)
};
let aadSignin = aadFunc("CrossWSTable1");
let aadNonInt = aadFunc("CrossWSTable2");
union isfuzzy=true aadSignin, aadNonInt