Query across Log Analytics workspaces in Resource-Context mode - "Unknown function: 'workspace'"

Nikolai 16 Reputation points
2024-04-10T13:28:08.0933333+00:00

Hi,

As detailed in Query data across Log Analytics workspaces there are primarily two ways of performing cross-workspace queries; "Explicitly by specifying the workspace" or "Implicitly by using resource-context queries. "

Is it possible to specify a workspace in resource-context queries? To me it seems this is only possible from within a Log Analytics workspace.

My resource-context queries are getting warnings because they query 8+ workspaces across multiple regions, so I would like to select only one workspace. Ref Optimize log queries in Azure Monitor.

I suppose this is partly due to the customer I'm working with is sending logs to multiple workspaces for some reason, but still.

Example queries im testing:

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cross-workspace-query#query-across-log-analytics-workspaces-using-workspace

Sample Query inside Log Analytics - WorksUser's image

Sample Query in resource-context - Does not work

Here im viewing logs in a resource group as an example, but the result is the same for all resource types.

User's image

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.