Scalar functions
DateTime/ Timespan functions
Function Name | Description |
---|---|
ago() | Subtracts the given timespan from the current UTC clock time. |
datetime_add() | Calculates a new datetime from a specified datepart multiplied by a specified amount, added to a specified datetime. |
datetime_part() | Extracts the requested date part as an integer value. |
datetime_diff() | Calculates calendarian difference between two datetime values. |
dayofmonth() | Returns the integer number representing the day number of the given month |
dayofweek() | Returns the integer number of days since the preceding Sunday, as a timespan. |
dayofyear() | Returns the integer number represents the day number of the given year. |
endofyear() | Returns the end of the year containing the date |
getmonth() | Get the month number (1-12) from a datetime. |
getyear() | Returns the year part of the datetime argument. |
hourofday() | Returns the integer number representing the hour number of the given date |
endofday() | Returns the end of the day containing the date |
now() | Returns the current UTC clock time, optionally offset by a given timespan. |
endofmonth() | Returns the end of the month containing the date |
endofweek() | Returns the end of the week containing the date. |
monthofyear() | Returns the integer number represents the month number of the given year. |
startofday() | Returns the start of the day containing the date |
startofmonth() | Returns the start of the month containing the date |
startofweek() | Returns the start of the week containing the date |
startofyear() | Returns the start of the year containing the date |
- We support the ISO 8601 format, which is the standard format for representing dates and times in the Gregorian calendar. Check them out here
ago()
Subtracts the given timespan from the current UTC clock time.
Arguments
- Interval to subtract from the current UTC clock time
Returns
now() - a_timespan
Example
ago(6h)
ago(3d)
datetime_add()
Calculates a new datetime from a specified datepart multiplied by a specified amount, added to a specified datetime.
Arguments
- period: string.
- amount: integer.
- datetime: datetime value.
Returns
A date after a certain time/date interval has been added.
Example
datetime_add(period,amount,datetime)
['sample-http-logs']
| project new_datetime = datetime_add( "month", 1, datetime(2016-10-06))
datetime_part()
Extracts the requested date part as an integer value.
Arguments
- date: datetime
- part: string
Returns
An integer representing the extracted part.
Examples
datetime_part(part,datetime)
['sample-http-logs']
| project new_datetime = datetime_part("Day", datetime(2016-06-26T08:20:03.123456Z))
datetime_diff()
Calculates calendarian difference between two datetime values.
Arguments
- period: string.
- datetime_1: datetime value.
- datetime_2: datetime value.
Returns
An integer, which represents amount of periods in the result of subtraction (datetime_1 - datetime_2).
Example
datetime_diff(period,datetime_1,datetime_2)
['sample-http-logs']
| project new_datetime = datetime_diff("week", datetime(2019-06-26T08:20:03.123456Z), datetime(2014-06-26T08:19:03.123456Z))
['sample-http-logs']
| project new_datetime = datetime_diff("week", datetime(2014-11-08), datetime(2014-11-08))
dayofmonth()
Returns the integer number representing the day number of the given month
Arguments
a_date
: Adatetime
Returns
day number of the given month.
Example
dayofmonth(a_date)
['sample-http-logs']
| project day_of_the_month = dayofmonth(datetime(2017-11-30))
dayofweek()
Returns the integer number of days since the preceding Sunday, as a timespan.
Arguments
- a_date: A datetime.
Returns
The timespan
since midnight at the beginning of the preceding Sunday, rounded down to an integer number of days.
Example
dayofweek(a_date)
['sample-http-logs']
| project day_of_the_week = dayofweek(datetime(2019-05-18))
dayofyear()
Returns the integer number represents the day number of the given year.
Arguments
a_date
: Adatetime.
Returns
day number
of the given year.
Example
dayofyear(a_date)
['sample-http-logs']
| extend day_of_the_year = dayofyear(datetime(2020-07-20))
endofyear()
Returns the end of the year containing the date
Arguments
- date: The input date.
Returns
A datetime representing the end of the year for the given date value
Example
endofyear(date)
['sample-http-logs']
| extend end_of_the_year = endofyear(datetime(2016-06-26T08:20))
getmonth()
Get the month number (1-12) from a datetime.
['sample-http-logs']
| extend get_specific_month = getmonth(datetime(2020-07-26T08:20))
getyear()
Returns the year part of the datetime
argument.
Example
getyear(datetime())
['sample-http-logs']
| extend get_specific_year = getyear(datetime(2020-07-26))
hourofday()
Returns the integer number representing the hour number of the given date
Arguments
- a_date: A datetime.
Returns
hour number of the day (0-23).
Example
hourofday(a_date)
['sample-http-logs']
| extend get_specific_hour = hourofday(datetime(2016-06-26T08:20:03.123456Z))
endofday()
Returns the end of the day containing the date
Arguments
- date: The input date.
Returns
A datetime representing the end of the day for the given date value.
Example
endofday(date)
['sample-http-logs']
| extend end_of_day_series = endofday(datetime(2016-06-26T08:20:03.123456Z))
now()
Returns the current UTC clock time, optionally offset by a given timespan. This function can be used multiple times in a statement and the clock time being referenced will be the same for all instances.
Arguments
- offset: A timespan, added to the current UTC clock time. Default: 0.
Returns
The current UTC clock time as a datetime.
Example
now([offset])
['sample-http-logs']
| extend returns_clock_time = now(-5d)
endofmonth()
Returns the end of the month containing the date
Arguments
- date: The input date.
Returns
A datetime representing the end of the month for the given date value.
Example
endofmonth(date)
['sample-http-logs']
| project end_of_the_month = endofmonth(datetime(2016-06-26T08:20))
endofweek()
Returns the end of the week containing the date
Arguments
- date: The input date.
Returns
A datetime representing the end of the week for the given date value
Example
endofweek(date)
['sample-http-logs']
| project end_of_the_week = endofweek(datetime(2019-04-18T08:20))
monthofyear()
Returns the integer number represents the month number of the given year.
Arguments
date
: A datetime.
Returns
month number of the given year.
Example
monthofyear(datetime("2018-11-21"))
['sample-http-logs']
| project month_of_the_year = monthofyear(datetime(2018-11-11))
startofday()
Returns the start of the day containing the date
Arguments
- date: The input date.
Returns
A datetime representing the start of the day for the given date value
Examples
startofday(datetime(2020-08-31))
['sample-http-logs']
| project start_of_the_day = startofday(datetime(2018-11-11))
startofmonth()
Returns the start of the month containing the date
Arguments
- date: The input date.
Returns
A datetime representing the start of the month for the given date value
Example
['github-issues-event']
| extend start_of_the_month = startofmonth(datetime(2020-08-01))
['hackernews']
| extend start_of_the_month = startofmonth(datetime(2020-08-01))
startofweek()
Returns the start of the week containing the date
Start of the week is considered to be a Sunday.
Arguments
- date: The input date.
Returns
A datetime representing the start of the week for the given date value
Examples
['github-issues-event']
| extend start_of_the_week = startofweek(datetime(2020-08-01))
['hackernews']
| extend start_of_the_week = startofweek(datetime(2020-08-01))
['sample-http-logs']
| extend start_of_the_week = startofweek(datetime(2018-06-11T00:00:00Z))
startofyear()
Returns the start of the year containing the date
Arguments
- date: The input date.
Returns
A datetime representing the start of the year for the given date value
Examples
['sample-http-logs']
| project yearStart = startofyear(datetime(2019-04-03))
['sample-http-logs']
| project yearStart = startofyear(datetime(2019-10-09 01:00:00.0000000))