range operator

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Generates a single-column table of values.

Note

This operator doesn't take a tabular input.

Syntax

range columnName from start to stop step step

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
columnName	string	✔️	The name of the single column in the output table.
start	int, long, real, datetime, or timespan	✔️	The smallest value in the output.
stop	int, long, real, datetime, or timespan	✔️	The highest value being generated in the output or a bound on the highest value if step steps over this value.
step	int, long, real, datetime, or timespan	✔️	The difference between two consecutive values.

Note

The values can't reference the columns of any table. If you want to compute the range based on an input table, use the range function potentially with the mv-expand operator.

Returns

A table with a single column called columnName, whose values are start, start + step, ... up to and until stop.

Examples

The following example creates a table with entries for the current time stamp extended over the past seven days, once a day.

Run the query

range LastWeek from ago(7d) to now() step 1d

Output

LastWeek
2015-12-05 09:10:04.627
2015-12-06 09:10:04.627
...
2015-12-12 09:10:04.627

The following example shows how to use the range operator with parameters, which are then extended and consumed as a table.

Run the query

let toUnixTime = (dt:datetime) 
{ 
    (dt - datetime(1970-01-01)) / 1s 
};
let MyMonthStart = startofmonth(now()); //Start of month
let StepBy = 4.534h; //Supported timespans
let nn = 64000; // Row Count parametrized
let MyTimeline = range MyMonthHour from MyMonthStart to now() step StepBy
| extend MyMonthHourinUnixTime = toUnixTime(MyMonthHour), DateOnly = bin(MyMonthHour,1d), TimeOnly = MyMonthHour - bin(MyMonthHour,1d)
; MyTimeline | order by MyMonthHour asc | take nn

Output

MyMonthHour	MyMonthHourinUnixTime	DateOnly	TimeOnly
2023-02-01	00:00:00.0000000	1675209600	2023-02-01 00:00:00.0000000
2023-02-01	04:32:02.4000000	1675225922.4	2023-02-01 00:00:00.0000000
2023-02-01	09:04:04.8000000	1675242244.8	2023-02-01 00:00:00.0000000
2023-02-01	13:36:07.2000000	1675258567.2	2023-02-01 00:00:00.0000000
...	...	...	...

The following example creates a table with a single column called Steps whose type is long and whose values are 1, 4, and 7.

Run the query

range Steps from 1 to 8 step 3

The following example shows how the range operator can be used to create a small, ad-hoc, dimension table that is then used to introduce zeros where the source data has no values.

range TIMESTAMP from ago(4h) to now() step 1m
| join kind=fullouter
  (Traces
      | where TIMESTAMP > ago(4h)
      | summarize Count=count() by bin(TIMESTAMP, 1m)
  ) on TIMESTAMP
| project Count=iff(isnull(Count), 0, Count), TIMESTAMP
| render timechart