Forum Discussion
Solved
Parameterized function in cross workspace queries
Hi,
I'm looking to get some input on a query I'm working on.
The thought is to create a query for each customer in our Lighthouse tenant, then be able to query a function named for the customer, so for example,
CustomerA("SigninLogs")
| where Identity contains "someperson"
However, when calling the function above, I'm getting the following error.
Is there some limitation with the workspace command or where am I doing wrong?
- Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.
There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/
- Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.
There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/- Thank you for the clarification, I will check out your workbook meanwhile 🙂
