Skip to main content
Use the startofmonth function in APL to round a datetime value down to the first day of the month at midnight (00:00:00). You can optionally shift the result by a specified number of months using the offset parameter. You can use startofmonth to bin events into monthly buckets for aggregation, reporting, and trend analysis. This is especially useful for monthly summaries, billing cycle calculations, and long-term trend monitoring. Use it when you want to:
  • Aggregate events or metrics by month.
  • Align timestamps to month boundaries for consistent reporting.
  • Track month-over-month changes in activity or error rates.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use relative_time with the @mon snap-to modifier to round a timestamp to the start of the month. In APL, the startofmonth function achieves the same result and supports an optional month offset.
... | eval month_start=relative_time(_time, "@mon")
In ANSI SQL, you use DATE_TRUNC('month', timestamp_column) to truncate a timestamp to the first day of the month. In APL, startofmonth provides the same functionality with an optional offset parameter.
SELECT DATE_TRUNC('month', timestamp_column) AS month_start FROM events;

​
Usage

​
Syntax

startofmonth(datetime [, offset])

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.
offsetlongOptional: The number of months to offset from the input datetime. Default is 0.

​
Returns

A datetime representing the start of the month (first day at 00:00:00) for the given date value, shifted by the offset if specified.

​
Use case examples

Count requests per month to identify monthly traffic trends.Query
['sample-http-logs']
| extend month_start = startofmonth(_time)
| summarize request_count = count() by month_start
| sort by month_start asc
Run in PlaygroundOutput
month_startrequest_count
2024-11-01T00:00:00Z42350
2024-12-01T00:00:00Z45120
2025-01-01T00:00:00Z38900
This query bins each HTTP request to the start of its month and counts the total requests per month.
  • endofmonth: Returns the end of the month for a datetime value.
  • startofday: Returns the start of the day for a datetime value.
  • startofweek: Returns the start of the week for a datetime value.
  • startofyear: Returns the start of the year for a datetime value.
  • monthofyear: Returns the month number from a datetime value.