Kusto query using TimeGenerated as Parameter

Question

I'm trying to use a Kusto query, taking the TimeGenerated field as input and get the below error.

Error is Query could not be parsed at 'datetime(start_time)'

let start_time =  Heartbeat | summarize min(TimeGenerated);
let end_time =  Heartbeat | summarize max(TimeGenerated);
Heartbeat
| where TimeGenerated > datetime(start_time) and TimeGenerated < datetime(end_time)

It works, when I set a constant to start_time or even use ago() function.

Answer 1

you could try this:

let times = toscalar(
    T1
    | summarize pack_array(min(timestamp), max(timestamp)) 
)
;
T2
| where timestamp > todatetime(times[0])
| where timestamp < todatetime(times[1])