Skip to main content
Use the getmonth function in APL to extract the month number from a datetime value. The function returns an integer from 1 to 12, where 1 represents January and 12 represents December. You can use getmonth to group records by month when analyzing seasonal patterns, monthly trends, or periodic fluctuations in your data. This is useful for dashboards, monthly reporting, and cohort analysis. Use it when you want to:
  • Aggregate events by month for trend analysis.
  • Compare metrics across months to detect seasonal patterns.
  • Create monthly summaries across log, trace, or security datasets.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the strftime function with the %m specifier to extract the month number. In APL, the getmonth function directly returns the month number as an integer.
... | eval month=strftime(_time, "%m")
In ANSI SQL, you use EXTRACT(MONTH FROM timestamp) or the MONTH() function to get the month number. In APL, getmonth provides the same result.
SELECT EXTRACT(MONTH FROM timestamp_column) AS month FROM events;

​
Usage

​
Syntax

getmonth(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int from 1 to 12 representing the month number.

​
Use case examples

Analyze HTTP request volume by month to identify traffic patterns throughout the year.Query
['sample-http-logs']
| extend month = getmonth(_time)
| summarize request_count = count() by month
| sort by month asc
Run in PlaygroundOutput
monthrequest_count
14521
24187
34893
This query groups HTTP log entries by month number and counts the requests in each month.
  • monthofyear: Returns the month number from a datetime. Equivalent to getmonth.
  • getyear: Extracts the year part from a datetime as an integer.
  • dayofmonth: Returns the day of the month from a datetime.
  • startofmonth: Returns the start of the month for a datetime, useful for monthly binning.
  • endofmonth: Returns the end of the month for a datetime value.