Skip to main content
Use the datetime_part function in APL to extract a specific date part from a datetime value as an integer. You can extract components such as the year, month, day, hour, minute, second, and more. You can use datetime_part to break down timestamps into individual components for grouping, filtering, or analysis. This is especially useful for time-of-day analysis, seasonal patterns, and partitioning data by calendar units. Use it when you want to:
  • Group events by hour of day to identify peak traffic periods.
  • Extract the month or quarter for seasonal trend analysis.
  • Partition data by year or day for reporting and aggregation.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use strftime with format specifiers such as %H for hour or %m for month to extract date parts. In APL, the datetime_part function takes a string-based part name and returns the corresponding integer directly.
... | eval hour=strftime(_time, "%H")
In ANSI SQL, you typically use EXTRACT(HOUR FROM timestamp_column) or DATEPART(HOUR, timestamp_column). In APL, datetime_part follows a similar pattern with a string-based part name as the first argument.
SELECT EXTRACT(HOUR FROM timestamp_column) AS hour FROM events;

​
Usage

​
Syntax

datetime_part(part, datetime)

​
Parameters

NameTypeDescription
partstringThe date part to extract: 'year', 'quarter', 'month', 'week_of_year', 'day', 'dayOfYear', 'hour', 'minute', 'second', 'millisecond', 'microsecond', 'nanosecond'.
datetimedatetimeThe datetime value to extract the part from.

​
Returns

An int representing the value of the extracted date part.

​
Use case examples

Analyze request volume by hour of day to find peak traffic periods.Query
['sample-http-logs']
| extend hour = datetime_part('hour', _time)
| summarize request_count = count() by hour
| sort by hour asc
Run in PlaygroundOutput
hourrequest_count
0312
1287
2198
This query extracts the hour from each request timestamp and counts requests per hour, revealing daily traffic patterns.
  • hourofday: Returns the hour of the day from a datetime. Use as a shorthand when you only need the hour.
  • dayofmonth: Returns the day of the month from a datetime.
  • dayofweek: Returns the day of the week as a timespan.
  • dayofyear: Returns the day of the year as an integer.
  • monthofyear: Returns the month number from a datetime.
  • getyear: Returns the year from a datetime.