hourofday

Use the hourofday function in APL to extract the hour of the day from a datetime value. The function returns an integer from 0 to 23, where 0 represents midnight and 23 represents 11 PM.

You can use hourofday to group records by hour for time-of-day analysis, peak traffic identification, and intraday pattern detection. This is useful for operational dashboards, capacity planning, and anomaly detection.

Use it when you want to:

• Identify peak traffic hours in your services.
• Analyze hourly patterns in request volume or error rates.
• Create time-of-day summaries across log, trace, or security datasets.

Usage

Syntax

hourofday(datetime)

Parameters

Returns

An int from 0 to 23 representing the hour of the day.

Use case examples

['sample-http-logs']
| extend hour = hourofday(_time)
| summarize request_count = count() by hour
| sort by hour asc

['otel-demo-traces']
| extend hour = hourofday(_time)
| summarize trace_count = count() by hour, ['service.name']
| sort by hour asc

['sample-http-logs']
| where toint(status) >= 400
| extend hour = hourofday(_time)
| summarize error_count = count() by hour
| sort by hour asc

List of related functions

• dayofweek: Returns the day of the week as a timespan, complementing hourly analysis with day-level detail.
• dayofmonth: Returns the day of the month from a datetime.
• datetime-part: Extracts a specific date part (such as hour) as an integer.
• startofday: Returns the start of the day for a datetime, useful for daily binning.
• endofday: Returns the end of the day for a datetime value.

Other query languages