Skip to main content
Use the dayofyear function in APL to extract the day number within the year from a datetime value. The function returns an integer from 1 to 365 (or 1 to 366 in a leap year) representing how far into the year the given date falls. You can use dayofyear to perform year-over-year comparisons by day, analyze seasonal trends, and track how metrics evolve throughout the year. This is especially useful for time-series analysis where you want to align data across multiple years by day number. Use it when you want to:
  • Compare activity or metrics on the same day across different years.
  • Identify seasonal trends and patterns in log, trace, or security data.
  • Track progress through the year for cumulative reporting.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the strftime function with the %j specifier to extract the day of the year. In APL, the dayofyear function directly returns the day number within the year from a datetime value.
... | eval doy=strftime(_time, "%j")
In ANSI SQL, you often use EXTRACT(DOY FROM timestamp) or DAYOFYEAR(timestamp). The APL dayofyear function provides the same result, returning an integer from 1 to 366.
SELECT EXTRACT(DOY FROM timestamp_column) AS day_of_year FROM events;

​
Usage

​
Syntax

dayofyear(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int from 1 to 366 representing the day number within the year.

​
Use case examples

Track daily request counts across the year to spot high-traffic and low-traffic periods.Query
['sample-http-logs']
| extend day_of_year = dayofyear(_time)
| summarize request_count = count() by day_of_year
| sort by day_of_year asc
Run in PlaygroundOutput
day_of_yearrequest_count
1482
2531
3497
This query counts the total number of HTTP requests for each day of the year, helping you identify seasonal traffic patterns.
  • dayofmonth: Returns the day number within the month from a datetime.
  • dayofweek: Returns the day of the week as an integer, useful for weekday versus weekend analysis.
  • datetime_part: Extracts a specific date part (such as day or year) as an integer.
  • monthofyear: Returns the month number from a datetime, useful for monthly grouping.
  • getyear: Returns the year from a datetime, useful for year-level aggregation.