workspace() expression in Azure Monitor log query
workspace expression is used in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. This is useful to include log data in an Application Insights query and to query data across multiple workspaces in a log query.
- Identifier: Identifies the workspace using one of the formats in the table below.
|Resource Name||Human readable name of the workspace (also known as "component name")||workspace("contosoretail")|
|Qualified Name||Full name of the workspace in the form: "subscriptionName/resourceGroup/componentName"||workspace('Contoso/ContosoResource/ContosoWorkspace')|
|ID||GUID of the workspace||workspace("b438b3f6-912a-46d5-9db1-b42069242ab4")|
|Azure Resource ID||Identifier for the Azure resource||workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail")|
- You must have read access to the workspace.
- A related expression is
appthat allows you to query across Application Insights applications.
workspace("contosoretail").Update | count
workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count
workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count
union (workspace("myworkspace").Heartbeat | where Computer contains "Con"), (app("myapplication").requests | where cloud_RoleInstance contains "Con") | count
union (workspace("myworkspace").Heartbeat), (app("myapplication").requests) | where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))