Datetime / timespan 算术Datetime / timespan arithmetic

Kusto 支持对 datetimetimespan 类型的值执行算术运算:Kusto supports performing arithmetic operations on values of types datetime and timespan:

  • 可以将两个 datetime 值相减(但不能相加)来得到一个表示二者之差的 timespan 值。One can subtract (but not add) two datetime values to get a timespan value expressing their difference. 例如,datetime(1997-06-25) - datetime(1910-06-11) 是 Jacques-Yves Cousteau 去世时的年龄。For example, datetime(1997-06-25) - datetime(1910-06-11) is how old was Jacques-Yves Cousteau when he died.

  • 可以将两个 timespan 值相加或相减以得到一个二者之和或差的 timespan 值。One can add or subtract two timespan values to get a timespan value which is their sum or difference. 例如,1d + 2d 是三天。For example, 1d + 2d is three days.

  • 可以在一个 datetime 值的基础上加上或减去一个 timespan 值。One can add or subtract a timespan value from a datetime value. 例如,datetime(1910-06-11) + 1d 是 Cousteau 年龄增大了一天的日期。For example, datetime(1910-06-11) + 1d is the date Cousteau turned one day old.

  • 可以将两个 timespan 值相除,得到它们的商。One can divide two timespan values to get their quotient. 例如,1d / 5h 的结果为 4.8For example, 1d / 5h gives 4.8. 这样就可以将任何 timespan 值表示为另一个 timespan 值的倍数。This gives one the ability to express any timespan value as a multiple of another timespan value. 例如,若要以秒为单位表示一小时,只需将 1h 除以 1s1h / 1s(结果很明显:3600)。For example, to express an hour in seconds, simply divide 1h by 1s: 1h / 1s (with the obvious result, 3600).

  • 相反,一个数字值(如 doublelong)可以乘以 timespan 值来得到 timespan 值。Conversely, one can multiple a numeric value (such as double and long) by a timespan value to get a timespan value. 例如,可以将一个半小时表示为 1.5 * 1hFor example, one can express an hour and a half as 1.5 * 1h.

示例:Unix 时间Example: Unix time

Unix 时间(也称为 POSIX 时间或 UNIX Epoch 时间)是一种系统,用于将某个时间点描述为自协调世界时 (UTC) 1970 年 1 月 1 日星期四 00:00:00 以来经过的秒数(减去闰秒)。Unix time (also known as POSIX time or UNIX Epoch time) is a system for describing a point in time as the number of seconds that have elapsed since 00:00:00 Thursday, 1 January 1970, Coordinated Universal Time (UTC), minus leap seconds.

如果数据包括以整数形式表示的 Unix 时间,或者需要转换为这种时间,可使用以下函数:If your data includes representation of Unix time as an integer, or you require converting to it, the following functions are available:

let fromUnixTime = (t:long)
{ 
    datetime(1970-01-01) + t * 1sec 
};
print result = fromUnixTime(1546897531)
resultresult
2019-01-07 21:45:31.00000002019-01-07 21:45:31.0000000
let toUnixTime = (dt:datetime) 
{ 
    (dt - datetime(1970-01-01)) / 1s 
};
print result = toUnixTime(datetime(2019-01-07 21:45:31.0000000))
resultresult
15468975311546897531

备注

除上述函数外,请参阅用于 unix-epoch 时间转换的专用函数:unixtime_seconds_todatetime() unixtime_milliseconds_todatetime() unixtime_microseconds_todatetime() unixtime_nanoseconds_todatetime()In addition to the functions above, see dedicated functions for unix-epoch time conversions: unixtime_seconds_todatetime() unixtime_milliseconds_todatetime() unixtime_microseconds_todatetime() unixtime_nanoseconds_todatetime()