The earliestTime function returns the beginning of the current search’s time range, expressed as a Unix timestamp in seconds.

To get the end of the search’s time range, use latestTime().

Syntax

​

earliestTime()

Arguments

​

None.

Returns

​

A long containing the Unix timestamp, in seconds, of the start of the search’s time range.

Examples

​

Compute the rate of events per second across the search’s time window:

dataset=myDataset
|| summarize eventsPerSecond = count() / (latestTime() - earliestTime()) by host

Annotate each result with the boundaries of the search’s time range:

dataset=myDataset
|| extend window_start=earliestTime(), window_end=latestTime()
|| export to lake myAuditDataset