Azure Kusto syntax

Question

I need to run a very simple query

requests | where cloud_RoleName == "blabla" | summarize Count=count() by url | order by Count desc

only thing i need to get the data just from the past 5 minutes if i try this :

requests | where timestamp < ago(5m) | where cloud_RoleName == "blabla" | summarize Count=count() by url | order by Count desc

or this

requests | where cloud_RoleName == "blabla" and timestamp < ago(5m) | summarize Count=count() by url | order by Count desc

but all of them are returning answers with data older than 5 minutes. ive read the doc and i see no other way of writing this query

can anyone assist?

Should it be timestamp > ago(5m)? I mean if ago(5m) returns the timestamp from 5 minutes ago, you'd want the ones with a timestamp greater than that. — juunas
– juunas, Commented Jan 5, 2022 at 10:30

juunas · Accepted Answer · 2022-01-05 11:02:52Z

Make sure to check if the timestamp is greater than the result of ago(). It returns the timestamp from e.g. 5 minutes ago, so if you want the data that is within last 5 minutes, you want the ones with a timestamp higher than that.

So the query should be:

requests | where timestamp > ago(5m) | where cloud_RoleName == "blabla" | summarize Count=count() by url | order by Count desc

Collectives™ on Stack Overflow

Azure Kusto syntax

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related