Axiom
Overview

startofday

You can use startofday to bin events into daily buckets for aggregation, reporting, and trend analysis across log, trace, and security datasets.

Use it when you want to:

  • Group events by day for daily summaries and dashboards.
  • Align timestamps to day boundaries for consistent aggregation.
  • Compare metrics across different days.

Usage#

Syntax#

startofday(datetime [, offset])

Parameters#

Name Type Description
datetime datetime The input datetime value.
offset long Optional: The number of days to offset from the input datetime. Default is 0.

Returns#

A datetime representing the start of the day (00:00:00) for the given date value, shifted by the offset if specified.

Use case examples#

Count requests per day to identify daily traffic patterns.

Query

['sample-http-logs']
| extend day_start = startofday(_time)
| summarize request_count = count() by day_start
| sort by day_start asc

Run in Playground

Output

day_start request_count
2025-01-13T00:00:00Z 1523
2025-01-14T00:00:00Z 1687
2025-01-15T00:00:00Z 1445

This query bins each HTTP request to the start of its day and counts the total requests per day.

Calculate the daily average span duration for each service.

Query

['otel-demo-traces']
| extend day_start = startofday(_time)
| summarize avg_duration = avg(duration) by day_start, ['service.name']
| sort by day_start asc

Run in Playground

Output

day_start service.name avg_duration
2025-01-13T00:00:00Z frontend 00:00:01.2340000
2025-01-14T00:00:00Z frontend 00:00:01.1750000
2025-01-15T00:00:00Z frontend 00:00:01.2890000

This query groups trace spans by day and service, then calculates the average span duration for each combination.

Track daily error counts to identify days with unusual server error activity.

Query

['sample-http-logs']
| where toint(status) >= 500
| extend day_start = startofday(_time)
| summarize error_count = count() by day_start
| sort by day_start asc

Run in Playground

Output

day_start error_count
2025-01-13T00:00:00Z 12
2025-01-14T00:00:00Z 27
2025-01-15T00:00:00Z 8

This query filters for server errors and counts them per day to reveal daily error patterns.

  • endofday: Returns the end of the day for a datetime value.
  • startofweek: Returns the start of the week for a datetime value.
  • startofmonth: Returns the start of the month for a datetime value.
  • startofyear: Returns the start of the year for a datetime value.
  • bin: Rounds values down to a fixed-size bin, useful for grouping timestamps.

Other query languages#

Splunk SPL users

In Splunk SPL, you use relative_time with the @d snap-to modifier to round a timestamp to the start of the day. In APL, the startofday function achieves the same result and supports an optional day offset.

Splunk example

... | eval day_start=relative_time(_time, "@d")

APL equivalent

... | extend day_start = startofday(_time)
ANSI SQL users

In ANSI SQL, you use DATE_TRUNC('day', timestamp_column) to truncate a timestamp to the start of the day. In APL, startofday provides the same functionality with an optional offset parameter.

SQL example

SELECT DATE_TRUNC('day', timestamp_column) AS day_start FROM events;

APL equivalent

['dataset']
| extend day_start = startofday(_time)

Updated

Was this page helpful?