how to extract records of last 15 minutes from kusto

Question

I am creating a kql code in which i want to extract last 15 minutes data.. my code is as follows :-

  UserTable 
 | project Date=substring(RawData, 0, 22), RawData
 | project Date, RawData=substring(RawData, 24, 150)
   | where RawData has "useraccess"
     | where Date = now(todatetime(Date))

How do I extract the last 15 min data from Date columns. Also Date column I have extracted from the RawData Column so will it be possible to apply date fns on the table.

Sample data for UserTable is :-

Answer 1

You can use the ago function to do so, this would mean, add the line:

| where TimeGenerated > ago(15m)

Details about the method you can find here: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/agofunction