now()now()

返回当前的 UTC 时钟时间,偏移量取决于给定的时间跨度(可选)。Returns the current UTC clock time, optionally offset by a given timespan. 此函数可在语句中多次使用,并且所有实例引用的时钟时间均相同。This function can be used multiple times in a statement and the clock time being referenced will be the same for all instances.

now()
now(-2d)

语法Syntax

now([offset])now([offset])

参数Arguments

  • offsettimespan,已添加到当前的 UTC 时钟时间。offset: A timespan, added to the current UTC clock time. 默认值:0。Default: 0.

返回Returns

当前 UTC 时钟时间,用作 datetimeThe current UTC clock time as a datetime.

now() + offsetnow() + offset

示例Example

确定 predicate 标识事件后的时间间隔:Determines the interval since the event identified by the predicate:

T | where ... | extend Elapsed=now() - Timestamp