Axiom
Overview

getyear

You can use getyear to group records by year when analyzing multi-year trends, comparing annual performance, or building year-level summaries. This is useful for dashboards, long-term reporting, and historical analysis.

Use it when you want to:

  • Aggregate events by year for trend analysis.
  • Compare metrics across years to detect growth or decline.
  • Create year-level summaries across log, trace, or security datasets.

Usage#

Syntax#

getyear(datetime)

Parameters#

Name Type Description
datetime datetime The input datetime value.

Returns#

An int representing the year.

Use case examples#

Count HTTP requests by year to understand long-term traffic trends.

Query

['sample-http-logs']
| extend year = getyear(_time)
| summarize request_count = count() by year
| sort by year asc

Run in Playground

Output

year request_count
2024 52340
2025 61892

This query groups HTTP log entries by year and counts the total requests per year.

Compare trace volume across years by service to track annual growth in observability data.

Query

['otel-demo-traces']
| extend year = getyear(_time)
| summarize trace_count = count() by year, ['service.name']
| sort by year asc

Run in Playground

Output

year service.name trace_count
2024 frontend 12450
2024 cart 5320
2025 frontend 14780

This query counts traces per service per year, showing how trace volume changes annually for each service.

Track yearly error trends to identify whether error rates increase or decrease over time.

Query

['sample-http-logs']
| where toint(status) >= 400
| extend year = getyear(_time)
| summarize error_count = count() by year
| sort by year asc

Run in Playground

Output

year error_count
2024 1245
2025 1587

This query filters for HTTP errors (status 400 and above) and counts them per year to reveal annual error trends.

  • getmonth: Extracts the month number from a datetime as an integer.
  • dayofyear: Returns the day number within the year from a datetime.
  • monthofyear: Returns the month number from a datetime. Equivalent to getmonth.
  • startofyear: Returns the start of the year for a datetime, useful for year-level binning.
  • endofyear: Returns the end of the year for a datetime value.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically use the strftime function with the %Y specifier to extract the four-digit year. In APL, the getyear function directly returns the year as an integer.

Splunk example

... | eval year=strftime(_time, "%Y")

APL equivalent

... | extend year = getyear(_time)
ANSI SQL users

In ANSI SQL, you use EXTRACT(YEAR FROM timestamp) or the YEAR() function to get the year. In APL, getyear provides the same result.

SQL example

SELECT EXTRACT(YEAR FROM timestamp_column) AS year FROM events;

APL equivalent

['dataset']
| extend year = getyear(_time)

Updated

Was this page helpful?