Log Analytics - Time picker enhancements

[RoyGal]

Log Analytics time picker is an easy way to scope and control the query's time scope - directly from the UI without composing or altering your query code.

Time picker is also a great way to narrow down queries and zoom into the specific time where issues occurred.

The Log Analytics team has improved the way our time picker works.
We are happy to announce that that time picker now supports changing the query's time span - even if a time scope has been specified in the query!

How it works:

If your query doesn't contain a time scope - simply use the time picker to define the scope of time for your query.
Note that the default is 24 hours.

If your query specifies time - you can use the time picker to further narrow down the time scope:

Note: time scope will work in tandem with the time defined in the query. For example, If you defined a time span of 24 hours in your query and then used the time picker to define a 2 hour time span - your query result will show results from the last 2 hours.

You can always go back to the time set in query by selecting this option from the time picker:

Advanced options:

Log Analytics allows the selection of a specific time span, using the time picker.

You can click the 'custom' option in the time picker and specify your desired time:

This functionality makes specifying exact periods of time a breeze.

Summary:

Time picker is a great and easy way to specify time ranges for queries in Log Analytics.

Using the time picker saves a lot of time when composing queries and the fact that the time is a dynamic part of the UI makes time based exploration a breeze.

Feedback:

Let us know what you think! please share your thoughts and comments about this enhancement in the comments section of this blog!

[KrzysztofRadomski]

The new approach is troublesome when using functions in saved searches. When invoking a function from a query, time picker sets by default "Set in query" while there is no query-set time range in a parent query rather than within a function. It's confusing because I obviously cannot see what time range is set in external function so I have no idea what time range will be applied to my query. Moreover, when such query is run (with timepicker set to default value of "Set in query"), only function is time-range limited (according to its definition) while the parent query which is calling the function seems not to be time-range limited, which technically means it searches the whole history. This makes the query run very slow, unnecessarily. It forces the user to be vigilant and intentionally set the time range with the timepicker or set it up in a query. Moreover, when the timerange is intentionally selected to avoid the aforementioned behavior and query is edited later on, it resets the timepicker to "Set in query".

A desired behavior should be that when a function is used, the default timerange of 24h should still apply to parent query when no time range is selected with a timepicker or no time range is set within a query; I would also expect the function to rely on its internal time range when it's executed regardless of what timepicker in parent query says. Also, when a timepicker is used to set the time range, it must retain its setting even after editing the query.

[RoyGal]

Hi @KrzysztofRadomski  and thank you for your feedback.
In Log Analytics, the entire query (including functions used within) is effected by the time picker.
The functions used within a query don't run in a different 'container' or scope - but run with the same context.

This means that time filter in the function will have an effect on the time scope of the entire screen.

We appreciate you reporting the issue with the identification of the time scope and we are working to improve this.

Thanks you!

[KrzysztofRadomski]

Hi @RoyGal ,

Thank you for your reply. But it doesn't explain why the timepicker resets to "Set in query" timerange when external function is in use. It doesn't make sense and, if I'm not vigilant to always remember to set the timepicker to some arbitrary time span, the whole history will be searched as if there was no timerange at all. It did not work like this before last changes and it was better, as the timepicker setting were set to 24h by default and retained between edits.

I found just another curiosity after last timepicker-related changes. Let's assume following query:

Heartbeat
| summarize MinTime=min(TimeGenerated), MaxTime=max(TimeGenerated), TimeDifference=(max(TimeGenerated)-min(TimeGenerated))  by Computer

Looks good. But when you type it in, see what timepicker says:

Where, for Odin's sake, does the editor see the query-set timerange? It's beyond me. When run, whole history is searched, returning the earliest heartbeat available.

Regards,

Krzysztof Radomski

[RoyGal]

@KrzysztofRadomski As mentioned before, thank you for reporting these bugs.
we are working on improving these annoyances.