Analytic rule - time frame

%3CLINGO-SUB%20id%3D%22lingo-sub-1357107%22%20slang%3D%22en-US%22%3EAnalytic%20rule%20-%20time%20frame%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1357107%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20to%20know%20if%20i%20configure%20an%20analytic%20rule%2C%20with%26nbsp%3B%3CSPAN%3E%22TimeGenerated%20%26lt%3B%3D%20ago(%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3Ed)%22%20inside%20the%20query%2C%20which%20time%20frame%20does%20it%20refer%20to%20when%20it%20is%20running%3F%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks%20!%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1357107%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1357633%22%20slang%3D%22en-US%22%3ERe%3A%20Analytic%20rule%20-%20time%20frame%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1357633%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F646380%22%20target%3D%22_blank%22%3E%40Yasta190%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ethe%20answer%20depends%20on%20your%20Log%20Analytics%20workspace%20data%20retention%20settings.%20For%20example%2C%20if%20you%20have%20retention%20configured%20for%2030%20days%2C%20then%20the%20query%20results%20will%20refer%20the%20time%20range%20between%20now-30d%20and%20now-1d.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1358425%22%20slang%3D%22en-US%22%3ERe%3A%20Analytic%20rule%20-%20time%20frame%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1358425%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F453722%22%20target%3D%22_blank%22%3E%40hspinto%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20always%20test%20the%20datetime%20information%20returned%2C%20one%20idea%20(or%20use%20arg_min%20or%20arg_max)%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20min%3C%2FSPAN%3E%3CSPAN%3E(%3C%2FSPAN%3E%3CSPAN%3ETimeGenerated%3C%2FSPAN%3E%3CSPAN%3E)%2C%3C%2FSPAN%3E%3CSPAN%3E%20max%3C%2FSPAN%3E%3CSPAN%3E(%3C%2FSPAN%3E%3CSPAN%3ETimeGenerated%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hi all,

 

I need to know if i configure an analytic rule, with "TimeGenerated <= ago(1d)" inside the query, which time frame does it refer to when it is running? 

 

Thanks ! 

2 Replies
Highlighted

@Yasta190 

 

the answer depends on your Log Analytics workspace data retention settings. For example, if you have retention configured for 30 days, then the query results will refer the time range between now-30d and now-1d.

Highlighted

@hspinto 

 

You can always test the datetime information returned, one idea (or use arg_min or arg_max): 

 

| summarize min(TimeGenerated), max(TimeGenerated)