Skip to main content
Use the startofday function in APL to round a datetime value down to the start of the day. The function returns midnight (00:00:00) for the date that contains the given datetime value. You can optionally shift the result by a specified number of days using the offset parameter. You can use startofday to bin events into daily buckets for aggregation, reporting, and trend analysis across log, trace, and security datasets. Use it when you want to:
  • Group events by day for daily summaries and dashboards.
  • Align timestamps to day boundaries for consistent aggregation.
  • Compare metrics across different days.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use relative_time with the @d snap-to modifier to round a timestamp to the start of the day. In APL, the startofday function achieves the same result and supports an optional day offset.
... | eval day_start=relative_time(_time, "@d")
In ANSI SQL, you use DATE_TRUNC('day', timestamp_column) to truncate a timestamp to the start of the day. In APL, startofday provides the same functionality with an optional offset parameter.
SELECT DATE_TRUNC('day', timestamp_column) AS day_start FROM events;

​
Usage

​
Syntax

startofday(datetime [, offset])

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.
offsetlongOptional: The number of days to offset from the input datetime. Default is 0.

​
Returns

A datetime representing the start of the day (00:00:00) for the given date value, shifted by the offset if specified.

​
Use case examples

Count requests per day to identify daily traffic patterns.Query
['sample-http-logs']
| extend day_start = startofday(_time)
| summarize request_count = count() by day_start
| sort by day_start asc
Run in PlaygroundOutput
day_startrequest_count
2025-01-13T00:00:00Z1523
2025-01-14T00:00:00Z1687
2025-01-15T00:00:00Z1445
This query bins each HTTP request to the start of its day and counts the total requests per day.
  • endofday: Returns the end of the day for a datetime value.
  • startofweek: Returns the start of the week for a datetime value.
  • startofmonth: Returns the start of the month for a datetime value.
  • startofyear: Returns the start of the year for a datetime value.
  • bin: Rounds values down to a fixed-size bin, useful for grouping timestamps.