todatetime

You typically use todatetime when working with date strings, timestamps, or other time representations that need to be converted to datetime format for time-based operations.

Usage#

Syntax#

todatetime(value)

Parameters#

Name	Type	Description
value	dynamic	The value to convert to datetime.

Returns#

If the conversion is successful, the result is a datetime value. If the conversion isn't successful, the result is null.

Conversion behavior#

The todatetime function converts values based on their type:

Integer/Float: Assumed to be nanoseconds since epoch.
String: Parsed using the dateparse package, which accepts many common date and time formats. See the upstream examples for supported formats.

Use case example#

Convert date strings from log fields to datetime values for time-based filtering and analysis.

Query

['sample-http-logs']
| extend log_date = todatetime('2024-06-24')
| extend is_recent = _time >= log_date
| where is_recent == true
| project _time, ['uri'], ['status'], log_date

Run in Playground

Output

_time	uri	status	log_date
Jun 24, 09:28:10	/api/users	200	2024-06-24T00:00:00Z

This example converts a date string to a datetime value and uses it for time-based comparisons, enabling precise date filtering in your queries.

totimespan: Converts input to timespan. Use totimespan for duration values, and todatetime for absolute time points.å

Other query languages#

Splunk SPL users

In Splunk, you use strptime or strftime functions to parse date strings, or eval with time functions. In APL, todatetime provides a direct conversion function that handles various date and time formats.

Splunk example

... | eval timestamp = strptime(date_field, "%Y-%m-%d %H:%M:%S")

APL equivalent

... | extend timestamp = todatetime(date_field)

ANSI SQL users

In standard SQL, you use CAST(... AS DATETIME) or TO_DATE functions to convert strings to datetime. In APL, todatetime provides a simpler way to convert various types to datetime values.

SQL example

SELECT CAST('2022-11-13' AS DATETIME) AS date_value FROM logs;