Query across resources

We’re excited to introduce cross-resources querying – the ability to query not only the current workspace or application, but analyze data from other resources as well, in a single query.

Until now, queries were limited to the scope of a single Application Insights app, or a single Log Analytics workspace. Today, we support querying across multiple apps or across multiple workspaces, providing a true system-wide view on your data.

Querying across Application Insights apps

Refer to an external application by using an app identifier:

union app('mmsportal-prod').requests, app('fabrikamapp').requests, requests
| summarize count() by bin(timestamp, 1h)

The above example queries records of the requests table in 3 separate apps: mmsportal-prod, fabrikamprod and my current app (which doesn’t require a name, I refer directly to the table). It then counts the total number of records, regardless of the application that holds each record.

Querying across Log Analytics workspaces

Refer to an external workspace by using a workspace identifier:

union Update, workspace("contosoretail-it").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

The above example queries the Update table both in my current workspace, and in another workspace named contosoretail-it. It then counts distinct records of needed updates by their classification, regardless of the workspace that holds each record.

Identifying resources

Identifying applications and workspace can be done in several ways:

1. Resource name – this is a human-readable name of the app or workspace. We sometimes refer to this as the “component name”.

   workspace("contosoretail").Update | count

   Note: Since workspace and app names are not unique across subscriptions or resource groups, this identifier can be ambiguous if the user has access to multiple components with the same name. In such cases the query will fail on ambiguity.

2. Qualified Name – this is the “full name” of the app or workspace, composed of thei subscription name, resource group and component name, in this format: //.

   app('AI-Prototype/Fabrikam/fabrikamprod').requests | count

   Note: Since Azure subscription names are not unique, this identifier might be ambiguous.

3. App or workspace ID – this is a GUID, the unique, immutable, public identifier of the app or workspace:

   workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count

4. Azure Resource ID – the Azure-defined identity of the app or workspace.
   • For apps, the format is: /subscriptions//resourcegroups//providers/microsoft.insights/components/.
     For example:

     app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp").requests | count

   • For workspaces, the format is: /subscriptions//resourcegroups//providers/microsoft.OperationalInsights/workspaces/.
   • For example:

     workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count

Favorite resources

A cool new feature is “Favorites” –  in the Analytics portal, the Scehma pane now has a list of your favorite resources, intended to provide quick access to the resources you query the most. To add an item to the list, you can either hover over the currently active resource and click the star icon, or select the “Edit” button and search for the relevant resource

In the context of cross-resource querying, you’ll notice that Intellisense suggests identifiers based on your favorites. Regardless of suggestions, you can in fact refer to any resource you have access to.

Next steps

Learn more on how to analyze your data:

· Query language doc site

· Getting started with queries