azurekqlazure-log-analytics-workspace

Datetime syntax seems valid, but causes a syntax error

I'm trying to query my customlogs table (Eg: CustomData_CL) by giving the time range. The result of this query will be the filtered time ranged data. I want to find out the data size of the resulted output.

Query which I have used to fetch the time ranged output:

CustomData_CL
| where TimeGenerated  between (datetime(2022–09–14 04:00:00) .. datetime(2020–09–14 05:00:00))

But it is giving the following error:

enter image description here

How can I fix it?

Solution

  • Note the characters with code point 8211.
    These are not standard hyphens (-) 🙂.

    let p_str = "(datetime(2022–09–14 04:00:00) .. datetime(2020–09–14 05:00:00))";
print str = p_str
| mv-expand str = extract_all("(.)", str) to typeof(string)
| extend dec = to_utf8(str)[0]
    str dec
    ( 40
    d 100
    a 97
    t 116
    e 101
    t 116
    i 105
    m 109
    e 101
    ( 40
    2 50
    0 48
    2 50
    2 50
    – 8211
    0 48
    9 57
    – 8211
    1 49
    4 52
    32
    0 48
    4 52
    : 58
    0 48
    0 48
    : 58
    0 48
    0 48
    ) 41
    32
    . 46
    . 46
    32
    d 100
    a 97
    t 116
    e 101
    t 116
    i 105
    m 109
    e 101
    ( 40
    2 50
    0 48
    2 50
    0 48
    – 8211
    0 48
    9 57
    – 8211
    1 49
    4 52
    32
    0 48
    5 53
    : 58
    0 48
    0 48
    : 58
    0 48
    0 48
    ) 41
    ) 41

    Fiddle

    Update, per OP request:

    Please note that in addition to the use of a wrong character that caused the syntax error, your 2nd datetime year was wrong.

    // Generation of mock table. Not part of the solution
let CustomData_CL = datatable(TimeGenerated:datetime)[datetime(2022-09-14 04:30:00)];
// Solution starts here
CustomData_CL
| where TimeGenerated  between (datetime(2022-09-14 04:00:00) .. datetime(2022-09-14 05:00:00))
    TimeGenerated
    2022-09-14T04:30:00Z

    Fiddle