15 Feb 2024 11:31 AM
Hi everyone, I’m trying to write a DQL query that filters the fetch logs by a specific time range across multiple days. For example, I want to retrieve only the logs from 22:00 to 07:00 for each day in a week, without having to change the query manually for each day. The documentation on the DT website shows how to use the timeframe parameter - fetch logs, timeframe:"2021-10-20T00:00:00Z/2021-10-28T12:00:00Z", but it returns all the logs between the start and end dates, not the ones that match the time range I need per day. Is it possible to achieve this?
Solved! Go to Solution.
15 Feb 2024 06:09 PM
you can utilize getHour() function. e.g.:
fetch logs, samplingRatio:1000
| filter getHour(timestamp)<7 or getHour(timestamp)>=22
| summarize {count()}, by: { bin(timestamp,10m)}