workspace-expression.md

title	description	services	documentationcenter	author	manager	editor	ms.assetid	ms.service	ms.workload	ms.tgt_pltfrm	ms.topic	ms.date	ms.author	ms.component
workspace() expression in Azure Log Analytics query | Microsoft Docs	The workspace expression is used in a Log Analytics query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription.	log-analytics		bwren	carmonm			log-analytics	na	na	article	09/10/2018	bwren	na

workspace() expression in Log Analytics query

The workspace expression is used in a Log Analytics query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. This is useful to include log data in an Application Insights query and to query data across multiple workspaces in a log query.

Syntax

workspace(Identifier)

Arguments

• Identifier: Identifies the workspace using one of the formats in the table below.

Identifier	Description	Example
Resource Name	Human readable name of the workspace (AKA "component name")	workspace("contosoretail")
Qualified Name	Full name of the workspace in the form: "subscriptionName/resourceGroup/componentName"	workspace('Contoso/ContosoResource/ContosoWorkspace')
ID	GUID of the workspace	workspace("b438b3f6-912a-46d5-9db1-b42069242ab4")
Azure Resource ID	Identifier for the Azure resource	workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail")

Notes

• You must have read access to the workspace.
• A related expression is app that allows you to query across Application Insights applications.

Examples

workspace("contosoretail").Update | count

workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count

workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count

union 
(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
(app("myapplication").requests | where cloud_RoleInstance contains "Con")
| count  

union 
(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))

Next steps

• See the app expression to refer to Application Insights app.
• Read about how Log Analytics data is stored.