In the output this resulted in 2,490,557 hours since the start of 2022.Īny unit could have worked, 1d would work for days, and is very common for larger timespans. In here we’ll divide the timespan by the unit we want, in this case hours. We can take our new column and pipe it into a second extend. Now we want to express that new timespan in hours. With the first extend operator, we created a new column, TimeSinceStartOfYear, which resulted in a timespan datatype. What if we needed the time returned in a single unit such as hours? Well that is possible too, using just a bit more date arithmetic. It returned the value in a timespan which had days, hours, minutes, and seconds. In the previous example, we calculated the time since the start of the year until an event was logged in our Perf table. Note, the resulting column from this calculation, TimeSinceStartOfYear, is not a datetime datatype, but rather a datatype of timespan. In this example we hard coded the date, in later posts we’ll show how to calcualte things like the start of the current year using functions built into Kusto. In the results pane, you can see the first row shows 103 days, 18 hours, 33 minutes, and 26.037 seconds since the start of the year! The format passed into datetime needs to be in YYYY-MM-DD format. This will take the string passed in and make it a datetime datatype. In order to convert a hard coded date, in this case January first of 2022, we need to use the datetime function. We know the TimeGenerated column is already a datetime, so we’re good to go there. In order for date arithmetic to work, all components must be of a datetime datatype. In it, we want to subtract the start of the year, January first, from the TimeGenerated. The only difference with this query and the previous one is the addition of a new calculated column, TimeSinceStartOfYear. In this example we’ll determine how long it has been since the start of the year 2022 (the current year as I write this). Time Since A DateĪnother use for DateTime arithmetic is determining how long it has been since a specific date. This was just so you could see the value being used in the previous calculation.įinally I pipe to a project to grab the few columns we need to verify our output. Within the extend I added a second column RightNow and set it equal to now. Sometimes using an item like parenthesis, even when not needed, may make your code more readable. Technically this wasn’t required, it was just to demonstrate the flexibility of the Kusto query language. I wrapped the calculation in parenthesis. I then assigned this calculated value to the column name of HowLongAgo, to prevent KQL from assigning it a dumb column name like Column1. To see how long ago this row was logged into the Perf table, we simply subtract the TimeGenerated column from the now function, which returns the current datetime. Now we fall into an extend, which is where the fun happens. Since this is just a demo we didn’t need 30,000 rows. That is piped into a take operator to give us a small sample set. We start by grabbing the Perf demo table, then piping it through two where operators to limit the data. We want to know how long ago something happened. In our first example we’ll do something extremely common. Finally, Microsoft may make changes to both the user interface and the data structures between the time I write this and when you read it. Second, I’ll be using the column tool (discussed in the introductory post) to limit the output to just the columns needed to demonstrate the query. First, Microsoft only keeps a few days of demo data, which are constantly updated, so the dates and sample data won’t match the screen shots. Note that my output may not look exactly like yours when you run the sample queries for several reasons. It describes the user interface in detail. If you’ve not read my introductory post in this series, I’d advise you to do so now. This demo site has been provided by Microsoft and can be used to learn the Kusto Query Language at no cost to you. The samples in this post will be run inside the LogAnalytics demo site found at. In this post we’ll see some examples of the most common DateTime arithmetic done when authoring KQL. You simply take one DateTime data type object and apply standard math to it, such as addition, subtraction, and more. Performing DateTime arithmetic in Kusto is very easy.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |