Using the workspace() expression in Azure Monitor log query
Use the workspace
expression in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. You can use this expression to include log data in an Application Insights query and to query data across multiple workspaces in a log query.
Permissions required
You must have Microsoft.OperationalInsights/workspaces/query/*/read
permissions to the Log Analytics workspaces you query, as provided by the Log Analytics Reader built-in role, for example.
Syntax
workspace(
Identifier)
Arguments
The workspace
expression takes the following arguments.
Identifier
Identifies the workspace by using one of the formats in the following table.
Identifier | Description | Example |
---|---|---|
ID | GUID of the workspace | workspace("00000000-0000-0000-0000-000000000000") |
Azure Resource ID | Identifier for the Azure resource | workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail") |
Note
We strongly recommend identifying a workspace by its unique ID or Azure Resource ID because they remove ambiguity and are more performant.
Examples
workspace("00000000-0000-0000-0000-000000000000").Update | count
workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count
union
( workspace("00000000-0000-0000-0000-000000000000").Heartbeat | where Computer == "myComputer"),
(app("00000000-0000-0000-0000-000000000000").requests | where cloud_RoleInstance == "myRoleInstance")
| count
union
(workspace("00000000-0000-0000-0000-000000000000").Heartbeat), (app("00000000-0000-0000-0000-000000000000").requests) | where TimeGenerated between(todatetime("2023-03-08 15:00:00") .. todatetime("2023-04-08 15:05:00"))
Next steps
- See the app expression, which allows you to query across Application Insights applications.
- Read about how Azure Monitor data is stored.
- Access full documentation for the Kusto query language.
Feedback
Submit and view feedback for