When using the datetime_utc_to_local
and format_datetime
functions, I’ve noticed the min and max functions become unaware on how to read the datetime and produce the wrong results.
Have I written this query wrong? What’s the alternative way to do this?
DeviceInfo
| where TimeGenerated > ago(30d)
| extend ['Generated Time AEST'] = format_datetime(datetime_utc_to_local(TimeGenerated,'Australia/Canberra'), 'dd-MM-yy [hh:mm:ss tt]')
| summarize count(), min(['Generated Time AEST']), max(['Generated Time AEST']) by DeviceName