Feb 11 2019
04:26 PM
- last edited on
Apr 07 2022
05:40 PM
by
TechCommunityAP
Feb 11 2019
04:26 PM
- last edited on
Apr 07 2022
05:40 PM
by
TechCommunityAP
Is there a way to systematically collect the workspace name and include it in the output of a log analytics query?
We are working on an event management project and the json output includes the workspaceID but not the name. Our CMDB currently doesn't populate the workspaceID. I am looking for a way to map the triggered alerts to a support group without having to hardcode mappings.
I was hoping I could use something like extend WS = workspace('uid').Name to add this data in.
Feb 12 2019 10:48 PM
SolutionHi,
There is no such option available as far as I know. If you manage your configuration as code you can potentially when deploying every query/alert that you have to put statically the name of the workspace with something like
| extend workspaceName = 'Workspace1'
Mark this reply as answer if it provides some answer to your question.
Feb 18 2019 02:56 PM
Thanks, for confirming. Looks like we are going to be modifying our servicenow discovery to include workspaceID so we have some way to correlate these events to an object in our CMDB
Feb 21 2024 07:57 AM
Maybe you can use this:
Usage
| where TimeGenerated > ago(1h)
| summarize arg_max(ResourceUri,*) by TimeGenerated
| extend dynamicuri = split(ResourceUri,"/")
| extend workspacename = dynamicuri.[-1]
| project workspacename
Feb 12 2019 10:48 PM
SolutionHi,
There is no such option available as far as I know. If you manage your configuration as code you can potentially when deploying every query/alert that you have to put statically the name of the workspace with something like
| extend workspaceName = 'Workspace1'
Mark this reply as answer if it provides some answer to your question.