topic Re: DQL Query: Filtering Logs by Time Range Across Multiple Days in DQL

DQL Query: Filtering Logs by Time Range Across Multiple Days

JerryJ — Thu, 15 Feb 2024 11:31:02 GMT

Hi everyone, I’m trying to write a DQL query that filters the fetch logs by a specific time range across multiple days. For example, I want to retrieve only the logs from 22:00 to 07:00 for each day in a week, without having to change the query manually for each day. The documentation on the DT website shows how to use the timeframe parameter - fetch logs, timeframe:"2021-10-20T00:00:00Z/2021-10-28T12:00:00Z", but it returns all the logs between the start and end dates, not the ones that match the time range I need per day. Is it possible to achieve this?

Re: DQL Query: Filtering Logs by Time Range Across Multiple Days

krzysztof_hoja — Thu, 15 Feb 2024 18:09:03 GMT

you can utilize getHour() function. e.g.:

fetch logs, samplingRatio:1000 | filter getHour(timestamp)<7 or getHour(timestamp)>=22 | summarize {count()}, by: { bin(timestamp,10m)}

Re: DQL Query: Filtering Logs by Time Range Across Multiple Days

walterdelgado — Wed, 30 Apr 2025 02:36:38 GMT

Hi krzysztof_hoja

Do you know any filter for timeseries?

Regards,

Walter