Skip to main content
Use the endofyear function in APL to return the end of the year containing a given datetime value. The function returns a datetime representing the last moment of that year (December 31, 23:59:59.9999999). You can use endofyear to align events to year-end boundaries, which is useful for annual aggregation, fiscal year analysis, and year-over-year comparisons in dashboards. Use it when you want to:
  • Group events by year-end boundaries for annual reporting.
  • Compare activity or metrics across calendar years.
  • Align timestamps to the end of the year for time-series bucketing.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, there is no direct equivalent to endofyear. You typically need to extract the year and manually construct the year-end timestamp. In APL, the endofyear function returns the last moment of the year in a single call.
... | eval year=strftime(_time, "%Y") | eval year_end=year."-12-31T23:59:59"
In ANSI SQL, you can calculate the end of the year by truncating to the year and adding an interval. Different SQL platforms offer varying syntax for this. In APL, endofyear provides this in a single function call.
SELECT DATE_TRUNC('year', timestamp_column) + INTERVAL '1 year' - INTERVAL '1 second' AS year_end FROM events;

​
Usage

​
Syntax

endofyear(datetime [, offset])

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.
offsetlongOptional: The number of years to offset from the input datetime. Default is 0.

​
Returns

A datetime representing the end of the year for the given date, shifted by the offset if specified. The return value is December 31 at 23:59:59.9999999 of the input year.

​
Use case examples

Count total HTTP requests per year to understand annual traffic volume.Query
['sample-http-logs']
| extend year_end = endofyear(_time)
| summarize total_requests = count() by year_end
| sort by year_end asc
Run in PlaygroundOutput
year_endtotal_requests
2024-12-31T23:59:59.9999999Z1523
2025-12-31T23:59:59.9999999Z2841
This query groups each HTTP log entry by its year-end boundary and counts the total number of requests per year.
  • startofyear: Returns the start of the year for a datetime value.
  • endofmonth: Returns the end of the month for a datetime, useful for monthly boundary calculations.
  • endofweek: Returns the end of the week for a datetime value.
  • endofday: Returns the end of the day for a datetime value.
  • getyear: Extracts the year part from a datetime as an integer.