Parameterized function in cross workspace queries

[SHoydal]

Hi, 

I'm looking to get some input on a query I'm working on.

The thought is to create a query for each customer in our Lighthouse tenant, then be able to query a function named for the customer, so for example,

CustomerA("SigninLogs")

| where Identity contains "someperson"

However, when calling the function above, I'm getting the following error. 

Is there some limitation with the workspace command or where am I doing wrong?

[#2 · Accepted solution]

Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.

There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/

[#3]

Thank you for the clarification, I will check out your workbook meanwhile 🙂