你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站,请访问 https://docs.azure.cn

ago()

Applies to: ✅ Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

Subtracts the given timespan from the current UTC time.

Like now(), if you use ago() multiple times in a single query statement, the current UTC time being referenced is the same across all uses.

Syntax

ago(timespan)

Learn more about syntax conventions.

Parameters

Name Type Required Description
timespan timespan ✔️ The interval to subtract from the current UTC clock time now(). For a full list of possible timespan values, see timespan literals.

Returns

A datetime value equal to the current time minus the timespan.

Example

All rows with a timestamp in the past hour:

T | where Timestamp > ago(1h)