between operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Filters a record set for data matching the values in an inclusive range.

between can operate on any numeric, datetime, or timespan expression.

Syntax

T | where expr between (leftRange..rightRange)

Name	Type	Required	Description
T	`string`	✔️	The tabular input whose records are to be matched. For example, the table name.
expr	scalar	✔️	The expression used to filter.
leftRange	int, long, real, or datetime	✔️	The expression of the left range. The range is inclusive.
rightRange	int, long, real, datetime, or timespan	✔️	The expression of the right range. The range is inclusive. This value can only be of type timespan if expr and leftRange are both of type `datetime`. See examples.

Rows in T for which the predicate of (expr >= leftRange and expr <= rightRange) evaluates to true.

In the following example, the rows are filtered by numeric values.

range x from 1 to 100 step 1
| where x between (50 .. 55)

Output

In the following example, the rows are filtered by date.

StormEvents
| where StartTime between (datetime(2007-07-27) .. datetime(2007-07-30))
| count

Output

Count
476

In the following example, the rows are filtered by date and time.

StormEvents
| where StartTime between (datetime(2007-12-01T01:30:00) .. datetime(2007-12-01T08:00:00))
| count

Output

Count
301

In the following example, the rows are filtered using a timespan range.

StormEvents
| where StartTime between (datetime(2007-07-27) .. 3d)
| count

Output

Count
476