between operator
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Filters a record set for data matching the values in an inclusive range.
between can operate on any numeric, datetime, or timespan expression.
Syntax
T | where expr between (leftRange..rightRange)
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| T | string |
✔️ | The tabular input whose records are to be matched. For example, the table name. |
| expr | scalar | ✔️ | The expression used to filter. |
| leftRange | int, long, real, or datetime | ✔️ | The expression of the left range. The range is inclusive. |
| rightRange | int, long, real, datetime, or timespan | ✔️ | The expression of the right range. The range is inclusive. This value can only be of type timespan if expr and leftRange are both of type datetime. See example. |
Returns
Rows in T for which the predicate of (expr >= leftRange and expr <= rightRange) evaluates to true.
Examples
Filter numeric values
range x from 1 to 100 step 1
| where x between (50 .. 55)
Output
| x |
|---|
| 50 |
| 51 |
| 52 |
| 53 |
| 54 |
| 55 |
Filter by date
StormEvents
| where StartTime between (datetime(2007-07-27) .. datetime(2007-07-30))
| count
Output
| Count |
|---|
| 476 |
Filter by date and time
StormEvents
| where StartTime between (datetime(2007-12-01T01:30:00) .. datetime(2007-12-01T08:00:00))
| count
Output
| Count |
|---|
| 301 |
Filter using a timespan range
StormEvents
| where StartTime between (datetime(2007-07-27) .. 3d)
| count
Output
| Count |
|---|
| 476 |