now()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Returns the current UTC time, optionally offset by a given timespan.

The current UTC time will stay the same across all uses of now() in a single query statement, even if there's technically a small time difference between when each now() runs.

Syntax

now([ offset ])

Learn more about syntax conventions.

Parameters

Name Type Required Description
offset timespan A timespan to add to the current UTC clock time. The default value is 0.

Returns

The current UTC clock time, plus the offset time if provided, as a datetime.

Examples

Show the current time

print now()

Show the time 2 days ago

print now(-2d)

Find time elapsed from a given event

The following example shows the time elapsed since the start of the storm events.

StormEvents
| extend Elapsed=now() - StartTime
| take 10

Get the date relative to a specific time interval

let T = datatable(label: string, timespanValue: timespan) [
    "minute", 60s, 
    "hour", 1h, 
    "day", 1d, 
    "year", 365d
];
T 
| extend timeAgo = now() - timespanValue

Output

label timespanValue timeAgo
year 365.00:00:00 2022-06-19T08:22:54.6623324Z
day 1.00:00:00 2023-06-18T08:22:54.6623324Z
hour 01:00:00 2023-06-19T07:22:54.6623324Z
minute 00:01:00 2023-06-19T08:21:54.6623324Z

Note

This operation can be accomplished with the ago() function.