DQL Query: Filtering Logs by Time Range Across Multiple Days

[JerryJ]

Hi everyone, I’m trying to write a DQL query that filters the fetch logs by a specific time range across multiple days. For example, I want to retrieve only the logs from 22:00 to 07:00 for each day in a week, without having to change the query manually for each day. The documentation on the DT website shows how to use the timeframe parameter - fetch logs, timeframe:"2021-10-20T00:00:00Z/2021-10-28T12:00:00Z", but it returns all the logs between the start and end dates, not the ones that match the time range I need per day. Is it possible to achieve this? 

[krzysztof_hoja · Accepted solution]

you can utilize getHour() function. e.g.:

fetch logs, samplingRatio:1000
| filter getHour(timestamp)<7 or getHour(timestamp)>=22
| summarize {count()}, by: { bin(timestamp,10m)}