Skip to main content
Use the dayofweek function in APL to extract the day of the week from a datetime value as an integer. The function returns the number of days since the preceding Sunday, where 0 represents Sunday, 1 represents Monday, and so on up to 6 for Saturday. You can use dayofweek to group and analyze records by the day of the week. This is especially useful for identifying weekday versus weekend patterns, scheduling-based filtering, and understanding cyclical behavior in your data. Use it when you want to:
  • Group events by day of the week to spot recurring patterns.
  • Compare weekday and weekend activity in logs, traces, or security data.
  • Filter records to specific days for schedule-based analysis.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the strftime function with the %w specifier to extract the day of the week as an integer (0=Sunday). In APL, the dayofweek function returns the same convention directly from a datetime value.
... | eval day=strftime(_time, "%w")
In ANSI SQL, you often use EXTRACT(DOW FROM timestamp) or DAYOFWEEK(timestamp). The exact numbering convention varies across platforms. APL’s dayofweek returns 0 for Sunday through 6 for Saturday.
SELECT EXTRACT(DOW FROM timestamp_column) AS day FROM events;

​
Usage

​
Syntax

dayofweek(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int representing the number of days since the preceding Sunday (0 for Sunday, 1 for Monday, through 6 for Saturday).

​
Use case examples

Analyze request volume by day of the week to identify peak traffic days.Query
['sample-http-logs']
| extend day = dayofweek(_time)
| summarize request_count = count() by day
| sort by day asc
Run in PlaygroundOutput
dayrequest_count
01204
11587
21632
This query groups HTTP log events by the day of the week and counts requests for each day, helping you spot which days see the most traffic.
  • dayofmonth: Returns the day number within the month from a datetime.
  • dayofyear: Returns the day number within the year from a datetime.
  • datetime_part: Extracts a specific date part (such as day or week) as an integer.
  • startofweek: Returns the start of the week for a datetime, useful for binning events to week boundaries.
  • endofweek: Returns the end of the week for a datetime.