Skip to main content
Use the endofday function in APL to calculate the end of the day for a given datetime value. The function returns a datetime set to the last moment of the day (23:59:59.9999999), with an optional offset to shift forward or backward by a specified number of days. You can use endofday to create daily time boundaries for aggregation, reporting, and filtering. This is especially useful when you need to bucket events into daily intervals or determine how much time remains until the end of a given day. Use it when you want to:
  • Define end-of-day boundaries for daily reports and dashboards.
  • Aggregate events up to the end of each day.
  • Calculate the remaining time in a day for each event.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, there is no direct equivalent to endofday. You typically use relative_time with snap-to syntax such as @d+1d-1s to approximate the end of the day. In APL, the endofday function handles this directly.
... | eval end=relative_time(_time, "@d+1d-1s")
In ANSI SQL, you typically combine DATE_TRUNC with interval arithmetic to get the end of the day. In APL, the endofday function provides this directly and supports an optional day offset.
SELECT DATE_TRUNC('day', timestamp_column) + INTERVAL '1 day' - INTERVAL '1 second' AS end_of_day FROM events;

​
Usage

​
Syntax

endofday(datetime [, offset])

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.
offsetlongOptional: The number of days to offset from the input date. Use negative values for past dates and positive values for future dates. Default is 0.

​
Returns

A datetime representing the end of the day (23:59:59.9999999) for the given date, shifted by the offset if specified.

​
Use case examples

Calculate how far each request is from the end of the day to understand the distribution of traffic within daily windows.Query
['sample-http-logs']
| extend end = endofday(_time)
| extend remaining_ms = datetime_diff('millisecond', end, _time)
| project _time, end, remaining_ms, method
Run in PlaygroundOutput
_timeendremaining_msmethod
2024-11-14T10:22:31Z2024-11-14T23:59:59.9999999Z49048000GET
2024-11-14T18:45:12Z2024-11-14T23:59:59.9999999Z18888000POST
2024-11-14T23:01:44Z2024-11-14T23:59:59.9999999Z3496000GET
This query computes the time remaining until the end of the day for each request, useful for understanding traffic distribution across daily windows.
  • startofday: Returns the start of the day for a datetime, useful for defining the beginning of daily intervals.
  • endofweek: Returns the end of the week for a datetime.
  • endofmonth: Returns the end of the month for a datetime.
  • endofyear: Returns the end of the year for a datetime.
  • now: Returns the current datetime, useful for calculating time until end of day.