Skip to main content
Use the startofweek function in APL to round a datetime value down to the start of the week. The function returns the preceding Sunday at midnight (00:00:00) for the date that contains the given datetime value. You can optionally shift the result by a specified number of weeks using the offset parameter. You can use startofweek to bin events into weekly buckets for aggregation, reporting, and trend analysis across log, trace, and security datasets. Use it when you want to:
  • Group events by week for weekly summaries and dashboards.
  • Align timestamps to week boundaries for consistent aggregation.
  • Compare metrics across different weeks.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use relative_time with the @w0 snap-to modifier to round a timestamp to the start of the week (Sunday). In APL, the startofweek function achieves the same result and supports an optional week offset.
... | eval week_start=relative_time(_time, "@w0")
In ANSI SQL, you use DATE_TRUNC('week', timestamp_column) to truncate a timestamp to the start of the week. Note that the start day of the week varies across SQL implementations. In APL, startofweek always uses Sunday as the start of the week.
SELECT DATE_TRUNC('week', timestamp_column) AS week_start FROM events;

​
Usage

​
Syntax

startofweek(datetime [, offset])

​
Parameters

NameTypeDescription
datetimedatetimeThe input datetime value.
offsetlongOptional: The number of weeks to offset from the input datetime. Default is 0.

​
Returns

A datetime representing the start of the week (Sunday at 00:00:00) for the given date value, shifted by the offset if specified.

​
Use case examples

Count requests per week to identify weekly traffic patterns.Query
['sample-http-logs']
| extend week_start = startofweek(_time)
| summarize request_count = count() by week_start
| sort by week_start asc
Run in PlaygroundOutput
week_startrequest_count
2025-01-05T00:00:00Z10234
2025-01-12T00:00:00Z11587
2025-01-19T00:00:00Z9876
This query bins each HTTP request to the start of its week and counts the total requests per week.
  • endofweek: Returns the end of the week for a datetime value.
  • startofday: Returns the start of the day for a datetime value.
  • startofmonth: Returns the start of the month for a datetime value.
  • startofyear: Returns the start of the year for a datetime value.
  • week_of_year: Returns the ISO 8601 week number from a datetime value.