Using the workspace() expression in Azure Monitor log query

  • Article

Use the workspace expression in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. You can use this expression to include log data in an Application Insights query and to query data across multiple workspaces in a log query.

Permissions required

You must have Microsoft.OperationalInsights/workspaces/query/*/read permissions to the Log Analytics workspaces you query, as provided by the Log Analytics Reader built-in role, for example.

Syntax

workspace(Identifier)

Arguments

The workspace expression takes the following arguments.

Identifier

Identifies the workspace by using one of the formats in the following table.

Identifier Description Example
ID GUID of the workspace workspace("00000000-0000-0000-0000-000000000000")
Azure Resource ID Identifier for the Azure resource workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail")

Note

We strongly recommend identifying a workspace by its unique ID or Azure Resource ID because they remove ambiguity and are more performant.

Examples

workspace("00000000-0000-0000-0000-000000000000").Update | count

workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count

union 
( workspace("00000000-0000-0000-0000-000000000000").Heartbeat | where Computer == "myComputer"),
(app("00000000-0000-0000-0000-000000000000").requests | where cloud_RoleInstance == "myRoleInstance")
| count  

union 
(workspace("00000000-0000-0000-0000-000000000000").Heartbeat), (app("00000000-0000-0000-0000-000000000000").requests) | where TimeGenerated between(todatetime("2023-03-08 15:00:00") .. todatetime("2023-04-08 15:05:00"))

Next steps