I have date and status values in a table, i want to select the date range for a period of 24h, I want to get all the status values including starting and ending date values. But those values were not present in the table. It has to get it from previous record.
I have attached the sample data in the screenshot for better understanding.
I have tried by creating a column with prev() staus value and by doing this i am not able to get the last record and its status value.
Can you help how can i get both starting and ending custom date values.
Also for selected time period if there is no data found, it should display the previous record. Is it possible?
I have used some dummy data to create a table. The UDF created expects starttime and endtime parameters to achieve the desired result asked in question.
Code/Query
let myFunc = (CustomStartDate : datetime ,CustomEndDate : datetime )
{
//Created temporary table named "tbl"
let tbl = datatable(Time: datetime , Status: string )
[
datetime(2023-03-16 07:14:58.4785756), "Running",
datetime(2023-03-16 11:15:49.7803968), "Stopped",
datetime(2023-03-16 13:46:31.8371005), "Idle",
datetime(2023-03-16 21:00:00.0000000),"Stopped",
datetime(2023-03-16 23:00:00.0000000),"Running",
datetime(2023-03-17 05:16:51.9252773), "Stopped",
datetime(2023-03-17 13:16:51.9252773), "Running"
];
//selecting records which falls between start date and end date and creating new temporary table named "tbl1"
let tbl1 = tbl | where Time between ( CustomStartDate .. CustomEndDate);
//creating 2 variables to store minimum and maximum time values within the custom time provided to get the previous and current status
let minDate = tbl1 | summarize min(Time);
let maxDate = tbl1 | summarize max(Time);
let PreStatus = tbl | where Time < toscalar(minDate)| order by Time desc | project Status | take 1;
let CustomEndStatus = tbl1 | where Time == toscalar(maxDate) |project Status ;
//Union custom dates and status with tbl1 and sorted the table on basis of Time ascending order.
tbl1
| union (print Time = CustomStartDate, Status = toscalar(PreStatus))
| union (print Time = CustomEndDate, Status = toscalar(CustomEndStatus ))
| order by Time asc
};
myFunc(datetime(2023-03-16 20:00:00.0000000),datetime(2023-03-17 12:00:00.0000000))
Result