Assign the end of the search time interval to the field provided by parameter as.

The time is represented as milliseconds since January 1, 1970 (UTC). In live queries (where the search time interval is forever moving), end() is equivalent to now() — that is, the current time.

Note

The parser does not have a search interval; therefore, it does not make sense to use the end() query function here.

ParameterTypeRequiredDefaultDescription
as[a]stringoptional[b]_end

[a] The argument name as can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for as can be omitted; the following forms of this function are equivalent:

logscale
end("_end")

and:

logscale
end(as="_end")

end() Examples

Assign e the value of end:

logscale
e := end()

Use end() in an assignment:

logscale
isOld := (end()-@timestamp) > 1000