search

splunk / splunk-add-on-microsoft-azure

Splunk Add-on for Microsoft Azure
Apache License 2.0
11 stars 9 forks source link

Add a start date to the KQL query #13

Closed JasonConger closed 4 months ago

JasonConger commented 2 years ago

Starting a new issue based on a the thread in #9. Currently, the KQL input relies on the KQL input to provide a relative range and uses the input interval to execute that relative range. For example, a relative range may look something like this: AzureActivity | where TimeGenerated between (now(-30d)..now()). The request is to add a start date to the KQL input and checkpoint the data returned instead of relying on the query.

raflyalk commented 1 year ago

Hi @JasonConger, wouldn't you think it would be better to use the TimeGenerated column on the query results to the _time as Splunk indexed timestamp, so the time the event was done can be in sync with Splunk and the Splunk time picker works as expected to show the correct event in the correct timestamp.