Forum Discussion

Copper Contributor

Jan 07, 2021

Kusto Query between TimeGenerated

Hi there, I want to be able to look into a Kusto query in the Perf table for Virtual Machines and I want the TimeGenerated to both be between 3 weeks ago - but also only the events in TimeGenerat...

ChrisBradshaw

Iron Contributor

Jan 07, 2021

Joseph Morley How about something like the following Query? It establishes a localTimestamp column to cater for the local timezone vs UTC conversion and then selects all records from the past 3 weeks (21 days) which happened after 0700 but before 2200 (in that calculated local time zone)

Perf
| extend localTimestamp = TimeGenerated - 5h
| where TimeGenerated > ago(21d)
| where hourofday( localTimestamp) >= 7
| where hourofday( localTimestamp) < 22

slavikn

Microsoft

Jan 20, 2021

Instead of:

| where hourofday(localTimestamp) <= 7

| where hourofday(localTimestamp) < 22

You can write:

| where hourofday(localTimestamp) between (7 .. 21)