Time and bins
Time and bins
Time ranges, bucketing, and turning a table into a series.
Every dataset has _time. Filtering on it is the cheapest thing you can do — the planner skips whole storage blocks that fall outside the range.
Ranges
| Expression | Means |
|---|---|
ago(1h) | One hour ago. Units: s m h d |
now() | Query start time |
startofday(now()) | Midnight UTC today. Also startofhour, startofweek, startofmonth |
between(a .. b) | Inclusive range |
datetime(2026-09-06) | An absolute instant |
LSQL
read top to bottom
1['api-gateway-prod']2| where _time between (ago(24h) .. now())3| where status >= 5004| summarize errors = count() by bin(_time, 1h), service5| order by _time ascbin and bin_auto
bin(_time, 5m) rounds each timestamp down to a five-minute boundary, which is how you turn events into a time series. bin_auto(_time) picks the step from the query's time range — right for dashboards where the user controls the window.
| Query range | bin_auto picks |
|---|---|
| ≤ 1 hour | 1 minute |
| ≤ 6 hours | 5 minutes |
| ≤ 1 day | 15 minutes |
| ≤ 7 days | 1 hour |
| ≤ 30 days | 6 hours |
| > 30 days | 1 day |
Gaps
summarize by bin(_time, …) produces no row for a bucket with no events, which draws a chart that skips rather than dips to zero. make-series fills the gaps.
LSQL
read top to bottom
1['api-gateway-prod']2| where _time > ago(6h)3| make-series errors = countif(status >= 500) default=04 on _time from ago(6h) to now() step 5m5 by serviceA dip to zero and a gap mean different things
A gap means no events at all — often the service is down, not healthy. Use
make-series with default=0 for anything an on-call engineer will read at 3am.