你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。
ago()
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Subtracts the given timespan from the current UTC time.
Like now(), if you use ago() multiple times in a single query statement, the current UTC time
being referenced is the same across all uses.
Syntax
ago(timespan)
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| timespan | timespan |
✔️ | The interval to subtract from the current UTC clock time now(). For a full list of possible timespan values, see timespan literals. |
Returns
A datetime value equal to the current time minus the timespan.
Example
All rows with a timestamp in the past hour:
T | where Timestamp > ago(1h)