Cross-workspace queries in azure log analytics .NE

Question

I'm using azure log analytics .NET SDK to execute some log analytics queries.

The nugget package I'm using for this SDK is Microsoft.Azure.OperationalInsights.

This allows me to issue some simple queries like in the following code sample :

Authentication & Simple query :

partial class QueryProvider
{

    private OperationalInsightsDataClient _operationalInsightsDataClient;


    private async void Authenticate()
    {

        // Retrieving the credentials and settings data from the app settings .
        var domain = SettingsHelpers.PullSettingsByKey("domain");
        var clientId = SettingsHelpers.PullSettingsByKey("clientId");
        var workspaceId = SettingsHelpers.PullSettingsByKey("workspaceId");

        var authEndpoint = SettingsHelpers.PullSettingsByKey("authEndpoint");
        var clientSecret = SettingsHelpers.PullSettingsByKey("clientSecret");
        var tokenAudience = SettingsHelpers.PullSettingsByKey("tokenAudience");


        // Authenticating to the azure log analytics service .
        var azureActiveDirectorySettings = new ActiveDirectoryServiceSettings
        {
            AuthenticationEndpoint = new Uri(authEndpoint),
            TokenAudience = new Uri(tokenAudience),
            ValidateAuthority = true
        };


        var credentials = await ApplicationTokenProvider.LoginSilentAsync
        (
              domain
            , clientId
            , clientSecret
            , azureActiveDirectorySettings
        );


        _operationalInsightsDataClient = new OperationalInsightsDataClient(credentials);
        _operationalInsightsDataClient.WorkspaceId = workspaceId;

    }


    public async Task<string> LogAnalyticsSamleQuery()
    {

        var query = @"Usage 
                    | where TimeGenerated > ago(3h)
                    | where DataType == 'Perf' 
                    | where QuantityUnit == 'MBytes'
                    | summarize avg(Quantity) by Computer
                    | sort by avg_Quantity desc nulls last";


       var jsonResult = await _operationalInsightsDataClient.QueryAsync(query);

        return JsonConvert.SerializeObject(jsonResult.Results);

    } 
}

Now I want to write a method that runs a cross-workspace query , I get the workspaces Ids dynamically and I want to build o query that references all those workspaces .

I did not find any sample in the doc to build such queries .

I found an attribute of OperationalInsightDataClient class called AdditionalWorkspaces but it's unclear how to use it to achieve the goal .

Any help would be very appreciated .

Answer 1

Use the ListWorkspaces method, store workspace Id , CustomerIdor Name in List.

var ws = new List<string>();
foreach (var w in workspaces)
{
     ws.Add(w.Id);
}

AdditionalWorkspaces is used to store workspaces you want to query, but has no influence on the query result.

_operationalInsightsDataClient.AdditionalWorkspaces = ws;

To cross-workspace query, add the list of workspace-Id in the query method.

var jsonResult = await _operationalInsightsDataClient.QueryAsync(query,null, _operationalInsightsDataClient.AdditionalWorkspaces);