Search code examples
kql

Only trigger a azure alert during certain times KQL

I want a azure alert to "check" and thus alert only between 9am and 10am - this sits wholly within azure monitor and I have just never got along with action group controls

  • I have a solution but I wondered if anyone has a better one

    let bd=format_datetime(now(), "dd/MM/yyyy"); let startdate = strcat(bd, ' 09:00 AM'); let Enddate = strcat(bd, ' 10:00 AM');

Event where TimeGenerated between (todatetime(startdate) .. todatetime(Enddate))

The alert this actually triggers is a far longer on that runs some very specific code so Ive only included the line which should restrict the code from alerting out of the specified hours

Solution

  • A solution working is always a working solution :)

    I would however use hourofday in cases like this.

    | where hourofday(TimeGenerated) == 9 //0900 to 0959