query_workspace
Need to analyze telemetry, logs, events, metrics, or time-series data? Run bounded, read-only KQL queries against a single Log Analytics workspace.
Instructions
Use for telemetry, logs, events, metrics, and time-series data stored in a Log Analytics workspace. Run bounded, read-only KQL against one workspace. Do not use for Azure resource inventory or configuration; use query_azure_resources for those.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Read-only KQL with a result-limiting operator. | |
| timespan | Yes | ISO 8601 duration, such as PT1H. | |
| workspaceId | Yes | Log Analytics workspace customer ID. |