Skip to main content
Use the monthofyear function in APL to extract the month number from a datetime value. The function returns an integer from 1 to 12, where 1 represents January and 12 represents December. The monthofyear and getmonth functions return the same result. Use either interchangeably. You can use monthofyear to group records by month when analyzing seasonal patterns, month-over-month comparisons, or periodic trends. This is useful for dashboards, monthly reporting, and cohort analysis. Use it when you want to:
  • Aggregate events by month for seasonal trend analysis.
  • Compare metrics month over month to detect recurring patterns.
  • Create monthly summaries across log, trace, or security datasets.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the strftime function with the %m specifier to extract the month number. In APL, the monthofyear function directly returns the month number as an integer.
... | eval month=strftime(_time, "%m")
In ANSI SQL, you use EXTRACT(MONTH FROM timestamp) or the MONTH() function to get the month number. In APL, monthofyear provides the same result.
SELECT EXTRACT(MONTH FROM timestamp_column) AS month FROM events;

​
Usage

​
Syntax

monthofyear(datetime)

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.

​
Returns

An int from 1 to 12 representing the month number of the year.

​
Use case examples

Analyze average request duration by month to identify seasonal performance variations.Query
['sample-http-logs']
| extend month = monthofyear(_time)
| summarize avg_duration = avg(req_duration_ms) by month
| sort by month asc
Run in PlaygroundOutput
monthavg_duration
1243.8
2238.5
3251.2
This query calculates the average request duration per month, helping you spot months with degraded performance.
  • getmonth: Returns the month number from a datetime. Equivalent to monthofyear.
  • getyear: Extracts the year part from a datetime as an integer.
  • dayofmonth: Returns the day of the month from a datetime.
  • startofmonth: Returns the start of the month for a datetime, useful for monthly binning.
  • endofmonth: Returns the end of the month for a datetime value.