Why is the same query syntax not supported in Log Analytics and Application Insight Logs?

Question

I am trying to figure out why the same query is not valid in both a Log Analytics and Application Insights workspace.

I've been working on creating a cross-resource query and when I write the syntax in Log Analytics it has a syntax error around the workspace operator. It is successful when I do the same thing in an Application Insights query.

The query looks like this:

union 
workspace("DefaultWorkspace-b432aa91-rrrr-qqqq-zzzz-aabbba7e8f42-WUS2").SecurityEvent
,workspace("DefaultWorkspace-fca02198a-aaaa-eeee-cccc-aaad9fbf7302-EUS").SecurityEvent 
| count 

Since in both workspaces it references other workspaces, I would think it would be portable if queried under the same tenant (which I am). In Azure Log Analytics it gives me the error:

Unknown function: 'workspace'.

I am running these in the Azure portal at the moment.

Answer 1

Can you try adding a space after the comma? This query is working for my own workspaces.

union workspace("DefaultWorkspace-b432aa91-rrrr-qqqq-zzzz-aabbba7e8f42-WUS2").SecurityEvent , workspace("DefaultWorkspace-fca02198a-aaaa-eeee-cccc-aaad9fbf7302-EUS").SecurityEvent | count

Answer 2

This is not a direct answer, but suggestions.

As far as I know, only if the query missing table name, then it will cause the error "Unknown function: 'workspace'.". Like below:

So first, make sure in your query, you are adding table name after workspace("xxx"). I notice that in your query, you're using the correct syntax, but just want to make sure the table name is there.

Second, if you're adding table name after workspace("xxx"), and still get this error. You can try just use the query below to check if the workspace("xxx") works:

workspace("adsmit-test").Heartbeat
| count

Please feel free to let me know if you still have the issue.

Answer 3

I tried the same statement 2 weeks later in both an Application Insights and Log Analytics and it works in both.