ago()ago()

• 10/29/2020
• • o
  • v

从当前 UTC 时钟时间减去给定时间跨度。Subtracts the given timespan from the current UTC clock time.

ago(1h)
ago(1d)

与 now() 类似，此函数可在语句中多次使用，并且所有实例化引用的 UTC 时钟时间均相同。Like now(), this function can be used multiple times in a statement and the UTC clock time being referenced will be the same for all instantiations.

语法Syntax

ago(a_timespan)ago(a_timespan)

参数Arguments

• a_timespan：要从当前 UTC 时钟时间 (now()) 减去的间隔。a_timespan : Interval to subtract from the current UTC clock time (now()).

返回Returns

now() - a_timespan

示例Example

过去一小时内具有时间戳的所有行：All rows with a timestamp in the past hour:

T | where Timestamp > ago(1h)