Skip to main content
Use the now function in APL to return the current UTC clock time as a datetime value, optionally offset by a given timespan. now is evaluated once at the start of the query and returns the same fixed value for the entire duration of the query, regardless of how long the query takes to run. This means all uses of now within a query refer to the same point in time. You can use now to calculate relative times, filter events by recency, and compute the age of records in your dataset. Use it when you want to:
  • Filter events to a recent time window.
  • Calculate how long ago an event occurred.
  • Add the current timestamp to query output for audit or comparison purposes.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, now() returns the current time as a Unix timestamp. In APL, now() returns a datetime value in UTC and supports an optional timespan offset to shift the returned time forward or backward.
... | eval current_time=now()
In ANSI SQL, you use CURRENT_TIMESTAMP or NOW() to retrieve the current date and time. In APL, now() behaves similarly but also accepts an optional timespan offset to shift the returned time.
SELECT CURRENT_TIMESTAMP AS current_time;

​
Usage

​
Syntax

now([offset])

​
Parameters

NameTypeDescription
offsettimespanOptional: A timespan added to the current UTC clock time. Default is 0.

​
Returns

The current UTC clock time as a datetime. All references to now() within a single statement return the same value.

​
Use case examples

Calculate the age of each request in hours to understand how recent events are.Query
['sample-http-logs']
| extend age_hours = datetime_diff('hour', now(), _time)
| project _time, age_hours, method, status
| take 10
Run in PlaygroundOutput
_timeage_hoursmethodstatus
2025-01-15T10:00:00Z48GET200
2025-01-15T10:05:00Z47POST201
2025-01-15T10:10:00Z47GET500
This query calculates how many hours ago each HTTP request occurred by comparing the event time to the current time.
  • ago: Subtracts a given timespan from the current UTC clock time.
  • datetime_add: Adds a specified amount to a datetime value.
  • datetime_diff: Calculates the difference between two datetime values.
  • startofday: Returns the start of the day for a datetime value.
  • endofday: Returns the end of the day for a datetime value.