For others, what I did was I created a lookup table with hour and value. So from the payload hour field was already extracted and being compared to the lookup table with hours define for off business in column Tag. The query to put using lookup after extracting the message | lookup offbusinesshours.csv Time as Tag_hour output Value as Value | where isnull(Value)
... View more