between operator

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Filters a record set for data matching the values in an inclusive range.

between can operate on any numeric, datetime, or timespan expression.

Syntax

T | where expr between (leftRange..rightRange)

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ The tabular input whose records are to be matched. For example, the table name.
expr scalar ✔️ The expression used to filter.
leftRange int, long, real, or datetime ✔️ The expression of the left range. The range is inclusive.
rightRange int, long, real, datetime, or timespan ✔️ The expression of the right range. The range is inclusive.

This value can only be of type timespan if expr and leftRange are both of type datetime. See example.

Returns

Rows in T for which the predicate of (expr >= leftRange and expr <= rightRange) evaluates to true.

Examples

Filter numeric values

range x from 1 to 100 step 1
| where x between (50 .. 55)

Output

x
50
51
52
53
54
55

Filter by date

StormEvents
| where StartTime between (datetime(2007-07-27) .. datetime(2007-07-30))
| count

Output

Count
476

Filter by date and time

StormEvents
| where StartTime between (datetime(2007-12-01T01:30:00) .. datetime(2007-12-01T08:00:00))
| count

Output

Count
301

Filter using a timespan range

StormEvents
| where StartTime between (datetime(2007-07-27) .. 3d)
| count

Output

Count
476