ago

The ago function subtracts the given timespan from the current UTC clock time.

Like now, this function can be used multiple times in a statement and the UTC clock time being referenced will be the same for all instantiations.

Syntax

​

    ago( Timespan )

Arguments

​

• Timespan: Interval to subtract from the current UTC clock time.

Returns

​

now() - Timespan

Example

​

All rows with a timestamp in the past hour:

dataset=myDataset
| where Timestamp > ago(1h)