ingestion_time()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Returns the approximate datetime in UTC format indicating when the current record was ingested.
This function must be used in the context of a table or a materialized view. Otherwise, this function produces null values.
If IngestionTime policy was not enabled when the data was ingested, the function returns null values.
Retrieves the datetime when the record was ingested and ready for query.
Note
The value returned by this function is only approximate, as the ingestion process may take several minutes to complete and multiple ingestion activities may take place concurrently. To process all records of a table with exactly-once guarantees, use database cursors.
Tip
The ingestion_time() function returns values according to the service clock as measured when ingestion was completed. As a result, this value cannot be used to "order" ingestion operations, as two operations that overlap in time might have any ordering of these values. If ordering records is important for application semantics, one should ensure that the table has a timestamp column as measured by the source of the data instead of relying on the ingestion_time() value.
Syntax
ingestion_time()
Learn more about syntax conventions.
Returns
A datetime value specifying the approximate time of ingestion into a table.
Example
T
| extend ingestionTime = ingestion_time() | top 10 by ingestionTime