Use additional log analytics workspaces in KQL script

Question

Use additional log analytics workspaces in KQL script

Michel Sfeir 190

Hello,

I'm trying to execute a KQL that retrieves the applications installed on the VMs, but i cannot seem to search in all workspaces dynamically (I want to avoid listing the workspaces manually). I don't know if the parameter "-AdditionalWorkspaces" is recognized in the below query.

$result = Invoke-AzOperationalInsightsQuery `

-WorkspaceId $primaryWorkspace.CustomerId `

-Query $query `

-AdditionalWorkspaces $additionalWorkspaceIDs

Thank you,

Michel

Michel Sfeir 190

In other words, the below query works well but how to retrieve the workspaces ID automatically and use them in this query.

$Query = 'union
    workspace("xxxxxxxxxxx").ConfigurationData,
    workspace("xxxxxxxxxxx").ConfigurationData
| where ConfigDataType == "Software"
| project Computer, SoftwareName, CurrentVersion
| order by Computer asc'


# Select the Log Analytics Workspace ID
$WorkspaceId = 'xxxxxxxxxxxxx'

# Retrieve the result of the Query 
$ResultList = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query $Query | `
   select -ExpandProperty Results

Accepted answer

0 additional answers

Your answer

Michel Sfeir 190 Reputation points

2025-04-16T10:18:13.6966667+00:00

In other words, the below query works well but how to retrieve the workspaces ID automatically and use them in this query.

$Query = 'union workspace("xxxxxxxxxxx").ConfigurationData, workspace("xxxxxxxxxxx").ConfigurationData | where ConfigDataType == "Software" | project Computer, SoftwareName, CurrentVersion | order by Computer asc' # Select the Log Analytics Workspace ID $WorkspaceId = 'xxxxxxxxxxxxx' # Retrieve the result of the Query $ResultList = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query $Query | ` select -ExpandProperty Results

Answer 1

Clive Watson 7,481 MVP

The function workspace("xxxxxxxxxxx") doesn't allow a variable so you have to hard code these

You could consider doing this query from within a Azure Monitor Workbook as that allows you to query any selected / visible workspace.

User's image

Otherwise using a Logic App or even the api's to enumerate through workspaces

Michel Sfeir 190 Reputation points

2025-04-16T13:18:30.31+00:00

Thank you Clive Watson, you're right, apparently it's not feasible so I will try to develop a script using both KQL and powershell.

Best Regards,

Michel

Share via

Use additional log analytics workspaces in KQL script

0 additional answers

Your answer