Axiom
Overview

endofyear

You can use endofyear to align events to year-end boundaries, which is useful for annual aggregation, fiscal year analysis, and year-over-year comparisons in dashboards.

Use it when you want to:

  • Group events by year-end boundaries for annual reporting.
  • Compare activity or metrics across calendar years.
  • Align timestamps to the end of the year for time-series bucketing.

Usage#

Syntax#

endofyear(datetime [, offset])

Parameters#

Name Type Description
datetime datetime The input datetime value.
offset long Optional: The number of years to offset from the input datetime. Default is 0.

Returns#

A datetime representing the end of the year for the given date, shifted by the offset if specified. The return value is December 31 at 23:59:59.9999999 of the input year.

Use case examples#

Count total HTTP requests per year to understand annual traffic volume.

Query

['sample-http-logs']
| extend year_end = endofyear(_time)
| summarize total_requests = count() by year_end
| sort by year_end asc

Run in Playground

Output

year_end total_requests
2024-12-31T23:59:59.9999999Z 1523
2025-12-31T23:59:59.9999999Z 2841

This query groups each HTTP log entry by its year-end boundary and counts the total number of requests per year.

Track yearly trace volume by service to compare annual activity across services.

Query

['otel-demo-traces']
| extend year_end = endofyear(_time)
| summarize trace_count = count() by year_end, ['service.name']
| sort by year_end asc

Run in Playground

Output

year_end service.name trace_count
2024-12-31T23:59:59.9999999Z frontend 5320
2024-12-31T23:59:59.9999999Z cart 2150
2025-12-31T23:59:59.9999999Z frontend 6100

This query counts traces per service per year, using year-end boundaries for grouping.

Summarize yearly error totals to identify years with elevated server error rates.

Query

['sample-http-logs']
| where toint(status) >= 500
| extend year_end = endofyear(_time)
| summarize error_count = count() by year_end
| sort by year_end asc

Run in Playground

Output

year_end error_count
2024-12-31T23:59:59.9999999Z 187
2025-12-31T23:59:59.9999999Z 342

This query filters for server errors and groups them by year-end boundary to reveal annual error totals.

  • startofyear: Returns the start of the year for a datetime value.
  • endofmonth: Returns the end of the month for a datetime, useful for monthly boundary calculations.
  • endofweek: Returns the end of the week for a datetime value.
  • endofday: Returns the end of the day for a datetime value.
  • getyear: Extracts the year part from a datetime as an integer.

Other query languages#

Splunk SPL users

In Splunk SPL, there is no direct equivalent to endofyear. You typically need to extract the year and manually construct the year-end timestamp. In APL, the endofyear function returns the last moment of the year in a single call.

Splunk example

... | eval year=strftime(_time, "%Y") | eval year_end=year."-12-31T23:59:59"

APL equivalent

... | extend year_end = endofyear(_time)
ANSI SQL users

In ANSI SQL, you can calculate the end of the year by truncating to the year and adding an interval. Different SQL platforms offer varying syntax for this. In APL, endofyear provides this in a single function call.

SQL example

SELECT DATE_TRUNC('year', timestamp_column) + INTERVAL '1 year' - INTERVAL '1 second' AS year_end FROM events;

APL equivalent

['dataset']
| extend year_end = endofyear(_time)

Updated

Was this page helpful?