The timespan data type

timespan literals

Literals of type timespan have the syntax timespan(value), where a number of formats are supported for value, as indicated by the following table:

The special form time(null) is the null value.

timespan operators

Two values of type timespan may be added, subtracted, and divided. The last operation returns a value of type real representing the fractional number of times one value can fit the other.

Examples

The following example calculates how many seconds are in a day in several ways:

print
    result1 = 1d / 1s,
    result2 = time(1d) / time(1s),
    result3 = 24 * 60 * time(00:01:00) / time(1s)

Example

The following query shows how the field "original_time" can be converted to a datetime format.

events_all 
| project data_source_name, unix_time = original_time
| where unix_time > ago(4d) 
| summarize Data= data_source_name, Time = bin(unix_time, 60) 
| order by Time desc
| take 1