Forum Discussion

Brass Contributor

Dec 18, 2023

Use of TimeRange parameter in workbooks

Hi, I use the timerange parameter as: | where Timestamp >= {TimeRange:start} and TimeGenerated <= {TimeRange:end} but need to incorporate into: | where Timestamp between ( startofday(...

Bronze Contributor

Dec 18, 2023

Hi Tim, I dont fully understand your question, are you trying to pass 14d and 7d into the syntax as a parameter. Usually you'd just use the {TimeRange:start} etc like you've shown.

Or do you mean:

| where Timestamp between ( startofday({TimeRange:start}) .. endofday({TimeRange:end}) )

tipper1510
Brass Contributor
Dec 18, 2023
Hi Clive,

I need to use the TimeRange parameter with the 14d ago and 7ago as need to get the previous weeks data for comparison but ensure I use the supplied initial TimeRange.

Regards,

Tim
- Clive_Watson
  Bronze Contributor
  Dec 18, 2023
  tipper1510
  
  Is this the type of result (using the Microsoft demo data), very simplified.
  
  Go to Log Analytics and run query
  
  // arg0
  let last30days=
  Heartbeat
  | where TimeGenerated between( ago(30d) .. now() )
  | summarize //min(TimeGenerated), max(TimeGenerated)
  count()
  by bin(TimeGenerated,1d)
  ;
  //arg1
  let last7days=
  Heartbeat
  | where TimeGenerated between( ago(14d) .. ago(7d) )
  | summarize //min(TimeGenerated), max(TimeGenerated)
  count()
  by bin(TimeGenerated,1d)
  ;
  union withsource=sourceTable last30days, last7days
  | render columnchart
  - tipper1510
    Brass Contributor
    Dec 18, 2023
    Hi Chris,
    
    Thanks for the reply's.
    
    I think so 🙂
    
    Need to be able to define TimeRange:start 14 days ago and TimeRange:end 7 days ago as my defined time period. As when certain workbooks are used exact dates and times are used in the TimeRange parameter.
    
    Regards,
    
    Tim

Resources