Skip to main content
Use the dayofmonth function in APL to extract the day number of the month from a datetime value. The function returns an integer from 1 to 31 representing the day within the month. You can use dayofmonth to analyze patterns tied to specific days of the month, such as billing cycles, payroll processing windows, or recurring scheduled events. Use it when you want to:
  • Detect traffic or error patterns that repeat on specific days of the month.
  • Group events by day of month for monthly trend analysis.
  • Correlate activity spikes with known monthly schedules such as billing or report generation.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use strftime(_time, "%d") to extract the day of the month. In APL, the dayofmonth function directly returns the day number as an integer.
... | eval day=strftime(_time, "%d")
In ANSI SQL, you typically use EXTRACT(DAY FROM timestamp_column) or DAY(timestamp_column) to get the day of the month. In APL, dayofmonth provides the same result with a single function call.
SELECT EXTRACT(DAY FROM timestamp_column) AS day FROM events;

​
Usage

​
Syntax

dayofmonth(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int from 1 to 31 representing the day number of the month.

​
Use case examples

Count requests by day of month to find recurring traffic patterns.Query
['sample-http-logs']
| extend day = dayofmonth(_time)
| summarize request_count = count() by day
| sort by day asc
Run in PlaygroundOutput
dayrequest_count
11450
21380
31520
This query groups HTTP requests by the day of the month, helping you identify days with consistently higher or lower traffic.
  • dayofweek: Returns the day of the week as a timespan. Use for weekly pattern analysis rather than monthly.
  • dayofyear: Returns the day of the year as an integer. Use when you need to track position within the full year.
  • datetime_part: Extracts a specific date part as an integer. Use when you need flexibility to extract different parts dynamically.
  • monthofyear: Returns the month number from a datetime. Use alongside dayofmonth for month-and-day breakdowns.
  • getmonth: Returns the month from a datetime as an integer.