ago()
Learn how to use the ago() function to subtract a given timespan from the current UTC clock time.
Subtracts the given timespan from the current UTC time.
Like now(), if you use ago() multiple times in a single query statement, the current UTC time
being referenced is the same across all uses.
Syntax
ago(timespan)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| timespan | timespan | ✔️ | The interval to subtract from the current UTC clock time now(). For a full list of possible timespan values, see timespan literals. |
Returns
A datetime value equal to the current time minus the timespan.
Example
All rows with a timestamp in the past hour:
T | where Timestamp > ago(1h)
Related content
- timespan datatype
- totimespan datatype
- make-timespan function
- startofday function
- startofweek function
- startofmonth function
- startofyear function
- endofday function
- endofweek function
- endofmonth function
- endofyear function
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.