Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Fcookbook%2Fconditionally_count.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Fcookbook%2Fconditionally_count.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Conditionally count logs before and after 1 hour ago

## Problem / Use case[​](#problem--use-case "Direct link to Problem / Use case")

You want to compare how many logs occurred in the last hour versus earlier. This helps validate time-based patterns, throttling, or backlogs.

## Query[​](#query "Direct link to Query")

```
source logs 

| countby if($m.timestamp > now() - 1h, 'last_hour', 'older')
```

## Expected output[​](#expected-output "Direct link to Expected output")

| \_expr0    | \_count   |
| ---------- | --------- |
| older      | 256305608 |
| last\_hour | 31830     |

Note

If your timestamp is stored as a string in ISO 8601 format, cast it to a proper timestamp using timestamp<!-- -->:timestamp<!-- --> before performing time arithmetic.

## Variations[​](#variations "Direct link to Variations")

* Swap `1h` for `30m`, `6h`, or `1d` to shift the time cutoff.
* Replace `timestamp` with any timestamp-related field like `event_time`, `created_at`, etc.

## TL;DR[​](#tldr "Direct link to TL;DR")

Use `if(timestamp > now() - 1h, ...)` inside `countby` to bucket logs into time-based groups. Perfect for detecting bursts or delays.