range operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Generates a single-column table of values.

range columnName from start to stop step step

Learn more about syntax conventions.

A table with a single column called columnName, whose values are start, start + step, ... up to and until stop.

The following example creates a table with entries for the current time stamp extended over the past seven days, once a day.

range LastWeek from ago(7d) to now() step 1d

Output

The following example shows how to use the range operator with parameters, which are then extended and consumed as a table.

let toUnixTime = (dt:datetime) 
{ 
    (dt - datetime(1970-01-01)) / 1s 
};
let MyMonthStart = startofmonth(now()); //Start of month
let StepBy = 4.534h; //Supported timespans
let nn = 64000; // Row Count parametrized
let MyTimeline = range MyMonthHour from MyMonthStart to now() step StepBy
| extend MyMonthHourinUnixTime = toUnixTime(MyMonthHour), DateOnly = bin(MyMonthHour,1d), TimeOnly = MyMonthHour - bin(MyMonthHour,1d)
; MyTimeline | order by MyMonthHour asc | take nn

Output

The following example creates a table with a single column called Steps whose type is long and whose values are 1, 4, and 7.

range Steps from 1 to 8 step 3

The following example shows how the range operator can be used to create a small, ad-hoc, dimension table that is then used to introduce zeros where the source data has no values.

range TIMESTAMP from ago(4h) to now() step 1m
| join kind=fullouter
  (Traces
      | where TIMESTAMP > ago(4h)
      | summarize Count=count() by bin(TIMESTAMP, 1m)
  ) on TIMESTAMP
| project Count=iff(isnull(Count), 0, Count), TIMESTAMP
| render timechart