range operator
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Generates a single-column table of values.
Notitie
This operator doesn't take a tabular input.
range
columnName from
start to
stop step
step
Learn more about syntax conventions.
Name | Type | Required | Description |
---|---|---|---|
columnName | string |
✔️ | The name of the single column in the output table. |
start | int, long, real, datetime, or timespan | ✔️ | The smallest value in the output. |
stop | int, long, real, datetime, or timespan | ✔️ | The highest value being generated in the output or a bound on the highest value if step steps over this value. |
step | int, long, real, datetime, or timespan | ✔️ | The difference between two consecutive values. |
Notitie
The values can't reference the columns of any table. If you want to compute the range based on an input table, use the range function potentially with the mv-expand operator.
A table with a single column called columnName,
whose values are start, start +
step, ... up to and until stop.
The following example creates a table with entries for the current time stamp extended over the past seven days, once a day.
range LastWeek from ago(7d) to now() step 1d
Output
LastWeek |
---|
2015-12-05 09:10:04.627 |
2015-12-06 09:10:04.627 |
... |
2015-12-12 09:10:04.627 |
The following example shows how to use the range
operator with parameters, which are then extended and consumed as a table.
let toUnixTime = (dt:datetime)
{
(dt - datetime(1970-01-01)) / 1s
};
let MyMonthStart = startofmonth(now()); //Start of month
let StepBy = 4.534h; //Supported timespans
let nn = 64000; // Row Count parametrized
let MyTimeline = range MyMonthHour from MyMonthStart to now() step StepBy
| extend MyMonthHourinUnixTime = toUnixTime(MyMonthHour), DateOnly = bin(MyMonthHour,1d), TimeOnly = MyMonthHour - bin(MyMonthHour,1d)
; MyTimeline | order by MyMonthHour asc | take nn
Output
MyMonthHour | MyMonthHourinUnixTime | DateOnly | TimeOnly |
---|---|---|---|
2023-02-01 | 00:00:00.0000000 | 1675209600 | 2023-02-01 00:00:00.0000000 |
2023-02-01 | 04:32:02.4000000 | 1675225922.4 | 2023-02-01 00:00:00.0000000 |
2023-02-01 | 09:04:04.8000000 | 1675242244.8 | 2023-02-01 00:00:00.0000000 |
2023-02-01 | 13:36:07.2000000 | 1675258567.2 | 2023-02-01 00:00:00.0000000 |
... | ... | ... | ... |
The following example creates a table with a single column called Steps
whose type is long
and whose values are 1
, 4
, and 7
.
range Steps from 1 to 8 step 3
The following example shows how the range
operator can be used to create a small, ad-hoc, dimension table that is then used to introduce zeros where the source data has no values.
range TIMESTAMP from ago(4h) to now() step 1m
| join kind=fullouter
(Traces
| where TIMESTAMP > ago(4h)
| summarize Count=count() by bin(TIMESTAMP, 1m)
) on TIMESTAMP
| project Count=iff(isnull(Count), 0, Count), TIMESTAMP
| render timechart