Returns the current UTC clock time, optionally offset by a given timespan. This function can be used multiple times in a statement and the clock time being referenced will be the same for all instances.
- offset: A
timespan, added to the current UTC clock time. Default: 0.
The current UTC clock time as a
now() + offset
Determines the interval since the event identified by the predicate:
T | where ... | extend Elapsed=now() - Timestamp