ago()

Switch services using the Version drop-down list. Learn more about navigation.
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Subtracts the given timespan from the current UTC time.

Like now(), if you use ago() multiple times in a single query statement, the current UTC time being referenced is the same across all uses.

Syntax

ago(timespan)

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
timespan	timespan	✔️	The interval to subtract from the current UTC clock time now(). For a full list of possible timespan values, see timespan literals.

Returns

A datetime value equal to the current time minus the timespan.

Example

All rows with a timestamp in the past hour:

T | where Timestamp > ago(1h)

Related content

• timespan datatype
• totimespan datatype
• make-timespan function
• startofday function
• startofweek function
• startofmonth function
• startofyear function
• endofday function
• endofweek function
• endofmonth function
• endofyear function