Skip to main content
Use the hourofday function in APL to extract the hour of the day from a datetime value. The function returns an integer from 0 to 23, where 0 represents midnight and 23 represents 11 PM. You can use hourofday to group records by hour for time-of-day analysis, peak traffic identification, and intraday pattern detection. This is useful for operational dashboards, capacity planning, and anomaly detection. Use it when you want to:
  • Identify peak traffic hours in your services.
  • Analyze hourly patterns in request volume or error rates.
  • Create time-of-day summaries across log, trace, or security datasets.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the strftime function with the %H specifier to extract the hour of the day. In APL, the hourofday function directly returns the hour as an integer.
... | eval hour=strftime(_time, "%H")
In ANSI SQL, you use EXTRACT(HOUR FROM timestamp) or the HOUR() function to get the hour. In APL, hourofday provides the same result.
SELECT EXTRACT(HOUR FROM timestamp_column) AS hour FROM events;

​
Usage

​
Syntax

hourofday(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int from 0 to 23 representing the hour of the day.

​
Use case examples

Analyze HTTP request volume by hour to identify peak traffic periods.Query
['sample-http-logs']
| extend hour = hourofday(_time)
| summarize request_count = count() by hour
| sort by hour asc
Run in PlaygroundOutput
hourrequest_count
0312
1287
141523
This query groups HTTP log entries by hour and counts the requests per hour, revealing peak and off-peak periods.
  • dayofweek: Returns the day of the week as a timespan, complementing hourly analysis with day-level detail.
  • dayofmonth: Returns the day of the month from a datetime.
  • datetime-part: Extracts a specific date part (such as hour) as an integer.
  • startofday: Returns the start of the day for a datetime, useful for daily binning.
  • endofday: Returns the end of the day for a datetime value.