Axiom
Overview

dayofmonth

You can use dayofmonth to analyze patterns tied to specific days of the month, such as billing cycles, payroll processing windows, or recurring scheduled events.

Use it when you want to:

  • Detect traffic or error patterns that repeat on specific days of the month.
  • Group events by day of month for monthly trend analysis.
  • Correlate activity spikes with known monthly schedules such as billing or report generation.

Usage#

Syntax#

dayofmonth(datetime)

Parameters#

Name Type Description
datetime datetime The input datetime value.

Returns#

An int from 1 to 31 representing the day number of the month.

Use case examples#

Count requests by day of month to find recurring traffic patterns.

Query

['sample-http-logs']
| extend day = dayofmonth(_time)
| summarize request_count = count() by day
| sort by day asc

Run in Playground

Output

day request_count
1 1450
2 1380
3 1520

This query groups HTTP requests by the day of the month, helping you identify days with consistently higher or lower traffic.

Find average span duration by day of month for each service.

Query

['otel-demo-traces']
| extend day = dayofmonth(_time)
| summarize avg_duration = avg(duration) by day, ['service.name']
| sort by day asc

Run in Playground

Output

day ['service.name'] avg_duration
1 frontend 00:00:01.1200000
1 cart 00:00:00.4500000
2 frontend 00:00:01.2500000

This query shows how average span duration varies by day of the month for each service, useful for detecting performance changes tied to monthly cycles.

Identify which days of the month have the most failed requests.

Query

['sample-http-logs']
| where toint(status) >= 400
| extend day = dayofmonth(_time)
| summarize error_count = count() by day
| sort by error_count desc

Run in Playground

Output

day error_count
15 98
1 87
28 76

This query ranks days of the month by error frequency, helping you correlate failures with recurring monthly events such as billing runs or batch jobs.

  • dayofweek: Returns the day of the week as a timespan. Use for weekly pattern analysis rather than monthly.
  • dayofyear: Returns the day of the year as an integer. Use when you need to track position within the full year.
  • datetime_part: Extracts a specific date part as an integer. Use when you need flexibility to extract different parts dynamically.
  • monthofyear: Returns the month number from a datetime. Use alongside dayofmonth for month-and-day breakdowns.
  • getmonth: Returns the month from a datetime as an integer.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically use strftime(_time, "%d") to extract the day of the month. In APL, the dayofmonth function directly returns the day number as an integer.

Splunk example

... | eval day=strftime(_time, "%d")

APL equivalent

... | extend day = dayofmonth(_time)
ANSI SQL users

In ANSI SQL, you typically use EXTRACT(DAY FROM timestamp_column) or DAY(timestamp_column) to get the day of the month. In APL, dayofmonth provides the same result with a single function call.

SQL example

SELECT EXTRACT(DAY FROM timestamp_column) AS day FROM events;

APL equivalent

['dataset']
| extend day = dayofmonth(_time)

Updated

Was this page helpful?