Skip to content

Commit a03610a

Browse files
Merge pull request #293955 from austinmccollum/patch-1
clarify use of explicit identifiers
2 parents 9f0cf61 + f76fe5f commit a03610a

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

articles/sentinel/extend-sentinel-across-workspaces-tenants.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,7 @@ Microsoft Sentinel supports a [multiple workspace incident view](./multiple-work
2525

2626
Query [multiple workspaces](/azure/azure-monitor/logs/cross-workspace-query) to search and correlate data from multiple workspaces in a single query.
2727

28-
- Use the [`workspace( )` expression](/azure/azure-monitor/logs/cross-workspace-query#query-across-log-analytics-workspaces-using-workspace), with the workspace identifier as the argument, to refer to a table in a different workspace.
29-
30-
- See [important information](/azure/azure-monitor/logs/cross-workspace-query#arguments) about the use of identifier formats to ensure proper performance.
28+
- Use the [`workspace( )` expression](/azure/azure-monitor/logs/cross-workspace-query#query-across-log-analytics-workspaces-using-workspace), with the workspace identifier as the argument, to refer to a table in a different workspace. Use explicit identifier formats to ensure best performance. For more information, see [Identifier formats for cross workspace queries](/azure/azure-monitor/logs/cross-workspace-query#arguments).
3129

3230
- Use the [union operator](/kusto/query/union-operator?view=microsoft-sentinel&preserve-view=true) alongside the `workspace( )` expression to apply a query across tables in multiple workspaces.
3331

0 commit comments

Comments
 (0)