!between operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Matches the input that is outside of the inclusive range.

!between can operate on any numeric, datetime, or timespan expression.

Syntax

T | where expr !between (leftRange..rightRange)

Name	Type	Required	Description
T	`string`	✔️	The tabular input whose records are to be matched.
expr	scalar	✔️	The expression to filter.
leftRange	int, long, real, or datetime	✔️	The expression of the left range. The range is inclusive.
rightRange	int, long, real, datetime, or timespan	✔️	The expression of the right range. The range is inclusive. This value can only be of type timespan if expr and leftRange are both of type `datetime`. See example.

Rows in T for which the predicate of (expr < leftRange or expr > rightRange) evaluates to true.

range x from 1 to 10 step 1
| where x !between (5 .. 9)

Output

StormEvents
| where StartTime !between (datetime(2007-07-27) .. datetime(2007-07-30))
| count

Output

Count
58590

StormEvents
| where StartTime !between (datetime(2007-07-27) .. 3d)
| count

Output

Count
58590