KustoTimeGrab

A tiny Windows tray app that grabs the timestamp from the currently-hovered point on a Kusto.Explorer chart and copies it to the clipboard — so you can paste it straight into your next KQL query.

What it does

1. You hover a point on a chart in Kusto.Explorer; the chart shows a tooltip like p999=5,132 at (2026-04-20 17:53:00).
2. You press Ctrl + Alt + T.
3. The timestamp (2026-04-20 17:53:00) is copied to the clipboard and a small tray balloon confirms the value.

How it works

• A global hotkey (Ctrl+Alt+T) is registered via RegisterHotKey.
• On press, the app uses UI Automation (via FlaUI) to enumerate Kusto.Explorer's UI tree and locate the Custom control whose Name matches the tooltip pattern <series>=<value> at (YYYY-MM-DD HH:MM:SS).
• Stale UIA elements that retain the previous tooltip text are filtered out by requiring IsOffscreen = false and a non-zero bounding rectangle.
• The timestamp substring is extracted via regex and written to the Windows clipboard.

Scanning Kusto's UIA tree typically takes ~2 seconds; a brief pause after the hotkey is expected.

Hotkey

Action	Shortcut
Grab chart timestamp	Ctrl+Alt+T

You can also trigger it from the tray icon's context menu (Grab timestamp now).

Logs

A rolling log is written to:

%LocalAppData%\KustoTimeGrab\KustoTimeGrab.log

It's capped at ~256 KB and rotates to KustoTimeGrab.log.old. Open the folder directly from the tray menu → Open log folder.

Build & install

Requires the .NET 10 SDK.

cd Q:\src\KustoTimeGrab
dotnet publish -c Release -r win-x64

The output is a self-contained tray app:

.\bin\Release\net10.0-windows\win-x64\publish\KustoTimeGrab.exe

Copy the whole net10.0-windows folder wherever you want to keep it (e.g. %LocalAppData%\Programs\KustoTimeGrab\) — it needs its companion DLLs.

Only one instance runs at a time; launching a second copy exits quietly.

Auto-start at login

1. Press Win + R, type shell:startup, press Enter.
2. Right-click in the opened Startup folder → New → Shortcut.
3. Point the shortcut at KustoTimeGrab.exe.
4. Done — it will launch on every login and sit in the system tray.

To disable, delete the shortcut from that folder (or use Settings → Apps → Startup).

Usage notes

• Kusto.Explorer must be running — the app looks for a process named Kusto.Explorer.
• Make sure the tooltip is actually visible on the chart when you press the hotkey. If no live tooltip is found, you'll see a "No tooltip found" balloon.
• If the chart tooltip label format changes in a future Kusto.Explorer release, the regex in TooltipFinder.cs (TooltipPattern) may need to be updated.