now()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns the current UTC time, optionally offset by a given timespan.

The current UTC time will stay the same across all uses of now() in a single query statement, even if there's technically a small time difference between when each now() runs.

now([ offset ])

Learn more about syntax conventions.

The current UTC clock time, plus the offset time if provided, as a datetime.

print now()

print now(-2d)

The following example shows the time elapsed since the start of the storm events.

StormEvents
| extend Elapsed=now() - StartTime
| take 10

let T = datatable(label: string, timespanValue: timespan) [
    "minute", 60s, 
    "hour", 1h, 
    "day", 1d, 
    "year", 365d
];
T 
| extend timeAgo = now() - timespanValue

Output