---
title: Conditionally count logs
description: Count logs from the last hour versus older logs by combining `countby` with an `if` condition on `$m.timestamp`.
url: https://coralogix.com/docs/dataprime/cookbook/conditionally_count/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-11-02'
---

# Conditionally count logs before and after 1 hour ago

## Problem / Use case

You want to compare how many logs occurred in the last hour versus earlier. This helps validate time-based patterns, throttling, or backlogs.

## Query

```
source logs 

| countby if($m.timestamp > now() - 1h, 'last_hour', 'older')
```

## Expected output

| \_expr0    | \_count   |
| ---------- | --------- |
| older      | 256305608 |
| last\_hour | 31830     |

Note

If your timestamp is stored as a string in ISO 8601 format, cast it to a proper timestamp using timestamp<!-- -->:timestamp<!-- --> before performing time arithmetic.

## Variations

* Swap `1h` for `30m`, `6h`, or `1d` to shift the time cutoff.
* Replace `timestamp` with any timestamp-related field like `event_time`, `created_at`, etc.

## TL;DR

Use `if(timestamp > now() - 1h, ...)` inside `countby` to bucket logs into time-based groups. Perfect for detecting bursts or delays.