Get Even More Visitors To Your Blog, Upgrade To A Business Listing >>

Azure Log Analytics: Cross Workspace Query

This was announced at Ignite last week, see here https://azure.microsoft.com/en-us/blog/query-across-resources/  which I missed at the time.   Adding the 'withsource=SourceTable' I have found to be really useful to see where the data was found.  If the returned SourceTable is just "SecurityEvent" as per this example its from your local workspace, if its workspace('').SecurityEvent 
// show AzureActivity in that workspace
union withsource=SourceTable SecurityEvent, workspace("fabrikamltd").SecurityEvent
| where (EventID
| summarize count() by EventID, SourceTable, Activity, Computer

// Look at just remote EventIDs
workspace("fabrikamltd").SecurityEvent
| where (EventID | summarize count() by EventID, Activity, Computer

Share the post

Azure Log Analytics: Cross Workspace Query

×

Subscribe to Msdn Blogs | Get The Latest Information, Insights, Announcements, And News From Microsoft Experts And Developers In The Msdn Blogs.

Get updates delivered right to your inbox!

Thank you for your subscription

×