Question:
How do I search data for a specific timeframe across multiple days? For example, I only want to return data from 14:00 to 16:00 for the last 7 days.
Answer:
In your query, you can parse the hour from the message time field and then filter by specified hours using a "where" statement.
Example:
| formatDate(_messagetime, "HH") as hour
| where (hour >= 14 and hour < 16)
Comments
0 comments
Please sign in to leave a comment.