FoxDeploy.com

KQL Quickie - Human Readable day of the week

Ever need to figure out which day of the week something happened, and you’re using an r or ADX like querying language?

Many of these offer a dayofweek function, but in many cases, these will give you a timespan interval since the previous Sunday. I don’t know about you, but for me, it’s very hard to just look at 1.00:00:00 and think “Oh yeah thats a Monday!

The query

Here is, short and sweet.

let weekday = (day:int) {        
        case(
        day == time(1.00:00:00), "Mon",
        day == time(2.00:00:00), "Tue",
        day == time(3.00:00:00), "Wed",
        day == time(4.00:00:00), "Thu",
        day == time(5.00:00:00), "Fri",
        day == time(6.00:00:00), "Sat",
        "Sun")
    };
    print weekday(1d);   

Result:

Mon

And a full working example

let weekday = (day:int) {        
        case(
        day == time(1.00:00:00), "Mon",
        day == time(2.00:00:00), "Tue",
        day == time(3.00:00:00), "Wed",
        day == time(4.00:00:00), "Thu",
        day == time(5.00:00:00), "Fri",
        day == time(6.00:00:00), "Sat",
        "Sun")
    };    
   range input from 0d to -6d step -1d
   | extend AsDate = ago(input)
   | extend AsWeekDayInt = dayofweek(AsDate)
   | extend AsDayOfWeek = weekday(AsWeekDayInt)

Result: