queryStartTime()
The queryStartTime() operator returns the start time of the query in milliseconds. You can use it in combination with queryEndTime() to establish times and ranges for your non-continuous queries.
Syntax
queryStartTime() as <field>
Rules
- An alias is required.
Examples
To get a duration of your query:
error
| (queryEndTime() - queryStartTime()) as duration
To list start time, end time, and duration:
error
| queryStartTime() as starttime
| queryEndTime() as endtime
| (endtime - starttime) as duration