Use local time in query

Question

I want my results from this query to show with local time not the UTC:

union * 
|  
order by timestamp desc

How would I go about getting that to show local time? I know it is some variation on dateadd(timestamp - 7h) but I can't figure out.

Answer 1

Since all datetimes are expressed in UTC, it is often useful to convert these into our local timezone. For simply viewing data, we can add a column using datetime math to add or subtract the necessary number of hours. You could refer to this article for more details.

union * 
| extend localTimestamp = timestamp - 7h
| order by localTimestamp desc