This was announced at Ignite last week, see here https://azure.microsoft.com/en-us/blog/query-across-resources/ which I missed at the time. Adding the 'withsource=SourceTable' I have found to be really useful to see where the data was found. If the returned SourceTable is just "SecurityEvent" as per this example its from your local workspace, if its workspace('
// show AzureActivity in that workspace
union withsource=SourceTable SecurityEvent, workspace("fabrikamltd").SecurityEvent
| where (EventID
| summarize count() by EventID, SourceTable, Activity, Computer
// Look at just remote EventIDs
| where (EventID | summarize count() by EventID, Activity, Computer
This post first appeared on MSDN Blogs | Get The Latest Information, Insights, Announcements, And News From Microsoft Experts And Developers In The MSDN Blogs., please read the originial post: here