Forum Discussion
rstanile
Aug 01, 2025Copper Contributor
Re: KQL: setting query time leads to problem in watchlist column projecting
I still can confirm the issue, and it is present when we want to go back in time for a few days.
This code gives me full watchlist:
_GetWatchlist("Svc_Accts_without_MFA")This code gives me only three records out of 75:
set query_datetimescope_column = "TimeGenerated";
set query_datetimescope_from = datetime(2025-07-03T23:00:00.000Z);
set query_datetimescope_to = datetime(2025-07-05T23:00:00.000Z);
set query_now=datetime(2025-07-05T23:00:00.000Z);
_GetWatchlist("Svc_Accts_without_MFA")All records in the watchlist were updated months ago.
The "set" commands should impact only DATA queries, using tables, not watchlists.
No RepliesBe the first to reply