Removed ambiguity in cross query

Author: yossi-y

articles/azure-monitor/logs/app-expression.md

@@ -4,7 +4,7 @@ description: The app expression is used in an Azure Monitor log query to retriev
 ms.topic: conceptual
 author: bwren
 ms.author: bwren
-ms.date: 08/06/2022
+ms.date: 04/20/2023
 
 ---
 
@@ -26,42 +26,34 @@ The `app` expression is used in an Azure Monitor query to retrieve data from a s
 
 | Identifier | Description | Example
 |:---|:---|:---|
-| Resource Name | Human readable name of the app (Also known as "component name") | app("fabrikamapp") |
-| Qualified Name | Full name of the app in the form: "subscriptionName/resourceGroup/componentName" | app('AI-Prototype/Fabrikam/fabrikamapp') |
-| ID | GUID of the app | app("988ba129-363e-4415-8fe7-8cbab5447518") |
-| Azure Resource ID | Identifier for the Azure resource |app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp") |
+| ID | GUID of the app | app("00000000-0000-0000-0000-000000000000") |
+| Azure Resource ID | Identifier for the Azure resource |app("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp") |
 
 
 ## Notes
 
 * You must have read access to the application.
-* Identifying an application by its name assumes that it is unique across all accessible subscriptions. If you have multiple applications with the specified name, the query will fail because of the ambiguity. In this case you must use one of the other identifiers.
+* Identifying an application by its ID or Azure Resource ID is strongly recommended since unique, removes ambiguity, and more performant.
 * Use the related expression [workspace](../logs/workspace-expression.md) to query across Log Analytics workspaces.
 
 ## Examples
 
 ```Kusto
-app("fabrikamapp").requests | count
+app("00000000-0000-0000-0000-000000000000").requests | count
 ```
 ```Kusto
-app("AI-Prototype/Fabrikam/fabrikamapp").requests | count
-```
-```Kusto
-app("b438b4f6-912a-46d5-9cb1-b44069212ab4").requests | count
-```
-```Kusto
-app("/subscriptions/7293b69-db12-44fc-9a66-9c2005c3051d/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp").requests | count
+app("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp").requests | count
 ```
 ```Kusto
 union 
-(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
-(app("myapplication").requests | where cloud_RoleInstance contains "Con")
+(workspace("00000000-0000-0000-0000-000000000000").Heartbeat | where Computer == "myComputer"),
+(app("00000000-0000-0000-0000-000000000000").requests | where cloud_RoleInstance == "myColumnInstance")
 | count  
 ```
 ```Kusto
 union 
-(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
-| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))
+(workspace("00000000-0000-0000-0000-000000000000").Heartbeat), (app("00000000-0000-0000-0000-000000000000").requests)
+| where TimeGenerated between(todatetime("2023-03-08 15:00:00") .. todatetime("2023-04-08 15:05:00"))
 ```
 
 ## Next steps

articles/azure-monitor/logs/query-optimization.md

@@ -22,7 +22,7 @@ Optimized queries will:
 - Run faster and reduce overall duration of the query execution.
 - Have smaller chance of being throttled or rejected.
 
-Pay particular attention to queries that are used for recurrent and bursty usage, such as dashboards, alerts, Azure Logic Apps, and Power BI. The impact of an ineffective query in these cases is substantial.
+Pay particular attention to queries that are used for recurrent and simultaneous usage, such as dashboards, alerts, Azure Logic Apps, and Power BI. The impact of an ineffective query in these cases is substantial.
 
 Here's a detailed video walkthrough on optimizing queries.
 
@@ -455,7 +455,7 @@ A query that spans more than five workspaces is considered a query that consumes
 
 > [!IMPORTANT]
 > - In some multi-workspace scenarios, the CPU and data measurements won't be accurate and will represent the measurement of only a few of the workspaces.
-> - Cross workspace queries having an explicit identifier: workspace ID, or workspace Resource Manager resource ID, consume less resources and are more performant. See [Create a log query across multiple workspaces](./cross-workspace-query.md#identify-workspace-resources)
+> - Cross workspace queries having an explicit identifier: workspace ID, or workspace Azure Resource ID, consume less resources and are more performant. See [Create a log query across multiple workspaces](./cross-workspace-query.md#identify-workspace-resources)
 
 ## Parallelism
 Azure Monitor Logs uses large clusters of Azure Data Explorer to run queries. These clusters vary in scale and potentially get up to dozens of compute nodes. The system automatically scales the clusters according to workspace placement logic and capacity.

articles/azure-monitor/logs/workspace-expression.md

@@ -4,7 +4,7 @@ description: The workspace expression is used in an Azure Monitor log query to r
 ms.topic: conceptual
 author: bwren
 ms.author: bwren
-ms.date: 08/06/2022
+ms.date: 04/20/2023
 
 ---
 
@@ -23,38 +23,33 @@ The `workspace` expression is used in an Azure Monitor query to retrieve data fr
 
 | Identifier | Description | Example
 |:---|:---|:---|
-| Resource Name | Human readable name of the workspace (also known as "component name") | workspace("contosoretail") |
-| Qualified Name | Full name of the workspace in the form: "subscriptionName/resourceGroup/componentName" | workspace('Contoso/ContosoResource/ContosoWorkspace') |
-| ID | GUID of the workspace | workspace("b438b3f6-912a-46d5-9db1-b42069242ab4") |
-| Azure Resource ID | Identifier for the Azure resource | workspace("/subscriptions/e4227-645-44e-9c67-3b84b5982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail") |
+| ID | GUID of the workspace | workspace("00000000-0000-0000-0000-000000000000") |
+| Azure Resource ID | Identifier for the Azure resource | workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail") |
 
 
 ## Notes
 
 * You must have read access to the workspace.
+* Identifying a workspace by its ID or Azure Resource ID is strongly recommended since unique, removes ambiguity, and more performant.
 * A related expression is `app` that allows you to query across Application Insights applications.
 
 ## Examples
 
 ```Kusto
-workspace("contosoretail").Update | count
+workspace("00000000-0000-0000-0000-000000000000").Update | count
 ```
 ```Kusto
-workspace("b438b4f6-912a-46d5-9cb1-b44069212ab4").Update | count
-```
-```Kusto
-workspace("/subscriptions/e427267-5645-4c4e-9c67-3b84b59a6982/resourcegroups/ContosoAzureHQ/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count
+workspace("/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail").Event | count
 ```
 ```Kusto
 union 
-(workspace("myworkspace").Heartbeat | where Computer contains "Con"),
-(app("myapplication").requests | where cloud_RoleInstance contains "Con")
+( workspace("00000000-0000-0000-0000-000000000000").Heartbeat | where Computer == "myComputer"),
+(app("00000000-0000-0000-0000-000000000000").requests | where cloud_RoleInstance == "myRoleInstance")
 | count  
 ```
 ```Kusto
 union 
-(workspace("myworkspace").Heartbeat), (app("myapplication").requests)
-| where TimeGenerated between(todatetime("2018-02-08 15:00:00") .. todatetime("2018-12-08 15:05:00"))
+(workspace("00000000-0000-0000-0000-000000000000").Heartbeat), (app("00000000-0000-0000-0000-000000000000").requests) | where TimeGenerated between(todatetime("2023-03-08 15:00:00") .. todatetime("2023-04-08 15:05:00"))
 ```
 
 ## Next steps