Cross-Workspace Query
A 2-step recipe with Azure Log Analytics. We can help you get access.
Recipe · 2 steps
Cross-Workspace Query
with Azure Log Analytics
List subscription workspaces, then run a KQL query spanning multiple of them.
- List the workspaces in the subscription so the participating workspaces can be confirmed before the cross-workspace query is issued.
- Execute the KQL query against the primary workspace while supplying the additional workspace IDs so the query spans all of them.
What you'll need to have ready
- subscriptionId: The ID of the target Azure subscription.
- workspaceId: The primary workspace GUID the query is issued against.
- additionalWorkspaces: Additional workspace IDs to include in the cross-workspace query.
- query: The KQL query to evaluate across all participating workspaces.
- timespan: Optional ISO 8601 duration limiting the query window (e.g. P1D).
- managementApiVersion: The management API version to use.
For your developer
Arazzo workflow azure-log-analytics:cross-workspace-query, 2 operations: listWorkspaces → postQuery. Specs on APIs.io.