datetime 数据类型The datetime data type

datetime (date) 数据类型表示某个时刻,通常以日期和当天的时间表示。The datetime (date) data type represents an instant in time, typically expressed as a date and time of day. 数值范围为从公历的公元 0001 年 1 月 1 日 00:00:00(午夜)到公元 9999 年 12 月 31 日Values range from 00:00:00 (midnight), January 1, 0001 Anno Domini (Common Era) through 11:59:59 P.M., December 31, 9999 A.D. 晚上 11:59:59。(C.E.) in the Gregorian calendar.

时间值以 100 纳秒为单位(称为时钟周期)进行度量。某个特定日期是指 GregorianCalendar 日历中自公元 0001 年 1 月 1 日午夜 12:00 以来的Time values are measured in 100-nanosecond units called ticks, and a particular date is the number of ticks since 12:00 midnight, January 1, 0001 A.D. 时钟周期数(不包括因考虑到闰秒而添加的时钟周期)。(C.E.) in the GregorianCalendar calendar (excluding ticks that would be added by leap seconds). 例如,时钟周期值 31241376000000000 表示 0100 年 1 月 1 日(星期五)午夜 12:00:00。For example, a ticks value of 31241376000000000 represents the date, Friday, January 01, 0100 12:00:00 midnight. 这有时称为“线性时间点”。This is sometimes called "a moment in linear time".


Kusto 中的 datetime 值始终在 UTC 时区中。A datetime value in Kusto is always in the UTC time zone. 在其他时区中显示 datetime 值是显示数据的用户应用程序的职责,而不是数据本身的属性。Displaying datetime values in other time zones is the responsibility of the user application that displays the data, not a property of the data itself. 如果需要将时区值保存为数据的一部分,则应使用单独的列(提供相对于 UTC 的偏移信息)。Should time zone values be required to be kept as a part of the data, a separate columns should be used (providing offset information relative to UTC).

datetime 文本datetime literals

datetime 类型的文本采用语法为 datetime(value),其中的 value 支持多种格式,如下表所示:Literals of type datetime have the syntax datetime(value), where a number of formats are supported for value, as indicated by the following table:

示例Example Value
datetime(2015-12-31 23:59:59.9)
时间始终采用 UTC。Times are always in UTC. 省略日期,提供当天时间。Omitting the date gives a time today.
datetime(null) 请参阅 NULL 值See null values.
now() 当前时间。The current time.
now(-timespan)now(-timespan) now()-timespannow()-timespan
ago(timespan)ago(timespan) now()-timespannow()-timespan

now()ago() 表示与 Kusto 开始执行查询时的时间点进行比较的 datetime 值。now() and ago() indicate a datetime value compared with the moment in time when Kusto started to execute the query. 这些可以在同一查询中出现多次,并且所有这些都将使用一个值。These can appear multiple times in the same query, and a single value will be used for them all. (换句话说,诸如 now(-x) - ago(x) 之类的表达式的求值始终为 timespan 值 0。)(In other words, expressions such as now(-x) - ago(x) always evaluate to a timespan value of zero.)

支持的格式Supported formats

datetime 有多种格式,这些格式可以用作 datetime() 文本todatetime() 函数。There are several formats for datetime that are supported as datetime() literals and the todatetime() function.


强烈建议只使用 ISO 8601 格式。It is strongly recommended to use only the ISO 8601 formats.

ISO 8601ISO 8601

格式Format 示例Example
%Y-%m-%dT%H:%M:%s%z%Y-%m-%dT%H:%M:%s%z 2014-05-25T08:20:03.123456Z2014-05-25T08:20:03.123456Z
%Y-%m-%dT%H:%M:%s"%Y-%m-%dT%H:%M:%s" 2014-05-25T08:20:03.1234562014-05-25T08:20:03.123456
%Y-%m-%dT%H:%M"%Y-%m-%dT%H:%M" 2014-05-25T08:202014-05-25T08:20
%Y-%m-%d %H:%M:%s%z"%Y-%m-%d %H:%M:%s%z" 2014-11-08 15:55:55.123456Z2014-11-08 15:55:55.123456Z
%Y-%m-%d %H:%M:%s"%Y-%m-%d %H:%M:%s" 2014-11-08 15:55:552014-11-08 15:55:55
%Y-%m-%d %H:%M"%Y-%m-%d %H:%M" 2014-11-08 15:552014-11-08 15:55
%Y-%m-%d%Y-%m-%d 2014-11-082014-11-08

RFC 822RFC 822

格式Format 示例Example
%w, %e %b %r %H:%M:%s %Z%w, %e %b %r %H:%M:%s %Z Sat, 8 Nov 14 15:05:02 GMTSat, 8 Nov 14 15:05:02 GMT
%w, %e %b %r %H:%M:%s%w, %e %b %r %H:%M:%s Sat, 8 Nov 14 15:05:02Sat, 8 Nov 14 15:05:02
%w, %e %b %r %H:%M%w, %e %b %r %H:%M Sat, 8 Nov 14 15:05Sat, 8 Nov 14 15:05
%w, %e %b %r %H:%M %Z%w, %e %b %r %H:%M %Z Sat, 8 Nov 14 15:05 GMTSat, 8 Nov 14 15:05 GMT
%e %b %r %H:%M:%s %Z%e %b %r %H:%M:%s %Z 8 Nov 14 15:05:02 GMT8 Nov 14 15:05:02 GMT
%e %b %r %H:%M:%s"%e %b %r %H:%M:%s" 8 Nov 14 15:05:028 Nov 14 15:05:02
%e %b %r %H:%M"%e %b %r %H:%M" 8 Nov 14 15:058 Nov 14 15:05
%e %b %r %H:%M %Z"%e %b %r %H:%M %Z" 8 Nov 14 15:05 GMT8 Nov 14 15:05 GMT

RFC 850RFC 850

格式Format 示例Example
%w, %e-%b-%r %H:%M:%s %Z%w, %e-%b-%r %H:%M:%s %Z Saturday, 08-Nov-14 15:05:02 GMTSaturday, 08-Nov-14 15:05:02 GMT
%w, %e-%b-%r %H:%M:%s%w, %e-%b-%r %H:%M:%s Saturday, 08-Nov-14 15:05:02Saturday, 08-Nov-14 15:05:02
%w, %e-%b-%r %H:%M %Z%w, %e-%b-%r %H:%M %Z Saturday, 08-Nov-14 15:05 GMTSaturday, 08-Nov-14 15:05 GMT
%w, %e-%b-%r %H:%M%w, %e-%b-%r %H:%M Saturday, 08-Nov-14 15:05Saturday, 08-Nov-14 15:05
%e-%b-%r %H:%M:%s %Z%e-%b-%r %H:%M:%s %Z 08-Nov-14 15:05:02 GMT08-Nov-14 15:05:02 GMT
%e-%b-%r %H:%M:%s"%e-%b-%r %H:%M:%s" 08-Nov-14 15:05:0208-Nov-14 15:05:02
%e-%b-%r %H:%M %Z"%e-%b-%r %H:%M %Z" 08-Nov-14 15:05 GMT08-Nov-14 15:05 GMT
%e-%b-%r %H:%M"%e-%b-%r %H:%M" 08-Nov-14 15:0508-Nov-14 15:05


格式Format 示例Example
%Y-%n-%e %H:%M:%s%Y-%n-%e %H:%M:%s 2014-11-08 15:05:252014-11-08 15:05:25
%Y-%n-%e %H:%M:%s %Z%Y-%n-%e %H:%M:%s %Z 2014-11-08 15:05:25 GMT2014-11-08 15:05:25 GMT
%Y-%n-%e %H:%M%Y-%n-%e %H:%M 2014-11-08 15:052014-11-08 15:05
%Y-%n-%e %H:%M %Z%Y-%n-%e %H:%M %Z 2014-11-08 15:05 GMT2014-11-08 15:05 GMT
%Y-%n-%eT%H:%M:%s%Y-%n-%eT%H:%M:%s 2014-11-08T15:05:252014-11-08T15:05:25
%Y-%n-%eT%H:%M:%s %Z%Y-%n-%eT%H:%M:%s %Z 2014-11-08T15:05:25 GMT2014-11-08T15:05:25 GMT
%Y-%n-%eT%H:%M%Y-%n-%eT%H:%M 2014-11-08T15:052014-11-08T15:05
%Y-%n-%eT%H:%M %Z"%Y-%n-%eT%H:%M %Z" 2014-11-08T15:05 GMT2014-11-08T15:05 GMT