I want to filter the time column in a table by the last full week of data. without explicitly giving the dates of the last full week.
lets say i want the last full week today (wednesday 6/3), which means i want last week 26/2 – 3/3. so i cant use 7d ago.
minimal reproducible example:
AzureActivity
| where TimeGenerated > ago(13d)
| summarize count() by bin(TimeGenerated,1d), dow=dayofweek(bin(TimeGenerated,1d))
| some filter here to make it only show data from dow = 0-6 but not inclusive of last 3 days
I have feeling i would be using the dayofweek function then using that output to filter again on the data?
>Solution :
you could use the startofweek() or endofweek() functions (the +1d below is because you want to start on a Monday, based on your example)
for example:
let start_time = 1d + startofweek(ago(7d));
AzureActivity
| where TimeGenerated between(start_time .. 7d)
| ...