The createdTime function returns the time when the current search was created, expressed as a Unix timestamp in seconds.

This is useful for annotating exported results with when the search was run, or for computing how much time has elapsed since the search started.

Syntax

​

createdTime()

Arguments

​

None.

Returns

​

A long containing the Unix timestamp, in seconds, of when the search was created.

Examples

​

Annotate exported results with the time the search was run:

dataset=myDataset
|| extend search_created=createdTime()
|| export to lake myAuditDataset

Build a full provenance record alongside the job ID and the user who ran the search:

dataset=myDataset
|| extend search_id=jobID(), run_by=user(), created_at=createdTime()
|| export to lake myAuditDataset