# Working with time in KQL

You want to define the time at the beginning at the query since it will drasticaly cut off a lot of logs.

It is used with the `where` command and the `TimeGenerated` field and a time command (ago, between, now\...)

### ago

if used with > the ago will return logs NEWER than time defined.

if used with < the ago will return logs OLDER than time defined.

#### syntax

```
where TimeGenerated [operator] ago([number][d=days, m=minutes, s=seconds])
```

Example:

```
FileCreationEvents
| where TimeGenerated > ago(1d)
```

result: empty

example:

```
FileCreationEvents
| where TimeGenerated < ago(1d)
```

result:

|                            |              |               |
| -------------------------- | ------------ | ------------- |
| 2022-01-03 20:08:12.451382 | B5HS-LAPTOP  | 15.jpg        |
| 2022-01-03 20:09:25.180969 | AXFE-DESKTOP | resources.pri |
| etc                        | etc          | etc           |

***

### between

the kql accept a few options to define the date time.

#### syntax:

```
where TimeGenerated [operator] between (datetime(date) .. datetime(date))
```

#### Example

```
SignInLOgs
| where TimeGenerated between (datetime(2025-7-5T02:00:00) .. datetime(2025-7-6T15:00:00))
```

You can define only date no time

```
SignInLOgs
| where TimeGenerated between (datetime(2025-7-5) .. datetime(2025-7-6))
```

***

### now

now function means... now like... current time.

#### Syntax

```
where TimeGenerated between (datetime() .. now())
```

#### Example

```
SignInLOgs
| where TimeGenerated between (datetime(2025-7-5) .. now())
```

```
SignInLOgs
| where TimeGenerated between (datetime(2025-7-5) .. now(-4))
```
