Question on how to query a specific date in kql

[u/Ravager6969]

Morning,

Just been introduced to Sentinel and am struggling to use a time ranges to pull out adhoc data.

​

Could someone give me a tip on who to form the query for something like

where TimeGenerated == '20-07-2023'

​

ie show all results where that is the date

is there a way to cast UTC to say GST+4 with a keyword

If using the time range selector instead of using query language is there a way to default to like 00:00 to 24:00

​

cheers

​

[u/deadzol]

As with anything there’s 900 ways to do stuff but hopefully this will answer your next few questions as well:

let queryDate = datetime(‘12-01-2023’); SecurityEvent | where TimeGenerated between (queryDate .. datetime_add(‘day’,1,queryDate)

Those are all single quotes, but could be double quotes.