Forum Discussion

rstanile's avatar
rstanile
Copper Contributor
Aug 01, 2025

Re: KQL: setting query time leads to problem in watchlist column projecting

I still can confirm the issue, and it is present when we want to go back in time for a few days. 

 

This code gives me full watchlist: 

_GetWatchlist("Svc_Accts_without_MFA")

This code gives me only three records out of 75: 

set query_datetimescope_column = "TimeGenerated";
set query_datetimescope_from = datetime(2025-07-03T23:00:00.000Z);
set query_datetimescope_to = datetime(2025-07-05T23:00:00.000Z);
set query_now=datetime(2025-07-05T23:00:00.000Z);
_GetWatchlist("Svc_Accts_without_MFA")

All records in the watchlist were updated months ago. 

The "set" commands should impact only DATA queries, using tables, not watchlists. 

No RepliesBe the first to reply

Resources