Kusto: How to filter Logs in a certain time period?

Question

I want to filter SignIn-Logs with Kusto whose timestamps are only between 6pm and 6am.

Something like that

SignInLogs
| where TimeGenerated between(dateStart .. dateEnd)

All examples I have found are always based on a full timestamp with exact date, like (2014-05-25T08:20:03.123456Z). But I am only interested in the time.

Any idea how to solve this?

Answer 1

Kusto: How to filter Logs in a certian time period?

• between operator - Filters a record set for data that falls within an inclusive range of values.
• between is used to allow a certain range, but you can also use !between to exclude a time range.
• Here Iam excluding from 6 am to 6 pm , so it gives the left over time range i.e.. from 6pm to 6 am

Try the below query

SignInLogs
| where TimeGenerated > ago(1d)
| extend hour = datetime_part("hour", TimeGenerated)
| where hour !between (6 .. 18)