Multiple L Aworkspaces
Query
union Update, workspace("1stLAWorkspace").Update, workspace("2ndLAWorkspace").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"Explanation
This query combines data from three sources: "Update", "1stLAWorkspace.Update", and "2ndLAWorkspace.Update". It filters the results to only include updates that were generated within the last hour and have a state of "Needed".