Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

KQL: Filter the last full week of data

I want to filter the time column in a table by the last full week of data. without explicitly giving the dates of the last full week.

lets say i want the last full week today (wednesday 6/3), which means i want last week 26/2 – 3/3. so i cant use 7d ago.

minimal reproducible example:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

AzureActivity
| where TimeGenerated > ago(13d)
| summarize  count() by  bin(TimeGenerated,1d), dow=dayofweek(bin(TimeGenerated,1d))
| some filter here to make it only show data from dow = 0-6 but not inclusive of last 3 days

I have feeling i would be using the dayofweek function then using that output to filter again on the data?

>Solution :

you could use the startofweek() or endofweek() functions (the +1d below is because you want to start on a Monday, based on your example)

for example:

let start_time = 1d + startofweek(ago(7d));
AzureActivity
| where TimeGenerated between(start_time .. 7d)
| ...
Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading