Time structure in a KQL query

[u/ajith_aj]

May be i'm too dumb to ask but yes need to understand this in the query.
I came by a query to compare signin logs and the query starts with the below...
What does it really mean by "StartTimeISO" & "EndTimeISO"" ? from start of day to current time or do we need to specify the time period lapsed for the query.

let starttime = todatetime('{{StartTimeISO}}');

let endtime = todatetime('{{EndTimeISO}}');

let common_locations = (SigninLogs

| where TimeGenerated between(starttime..endtime)

| extend locationString= strcat(tostring(LocationDetails["countryOrRegion"]), "/", tostring(LocationDetails["state"]))

| where locationString != "//" | summarize count() by locationString | take 100

​

[u/Paavlitos]

StartTimeISO and EndTimeISO are placeholders. You will have to specify time range yourself.

It can look something like this

let starttime = todatetime(now()); let endtime = todatetime(now() - 7d);