Axiom
Overview

startofweek

You can use startofweek to bin events into weekly buckets for aggregation, reporting, and trend analysis across log, trace, and security datasets.

Use it when you want to:

  • Group events by week for weekly summaries and dashboards.
  • Align timestamps to week boundaries for consistent aggregation.
  • Compare metrics across different weeks.

Usage#

Syntax#

startofweek(datetime [, offset])

Parameters#

Name Type Description
datetime datetime The input datetime value.
offset long Optional: The number of weeks to offset from the input datetime. Default is 0.

Returns#

A datetime representing the start of the week (Sunday at 00:00:00) for the given date value, shifted by the offset if specified.

Use case examples#

Count requests per week to identify weekly traffic patterns.

Query

['sample-http-logs']
| extend week_start = startofweek(_time)
| summarize request_count = count() by week_start
| sort by week_start asc

Run in Playground

Output

week_start request_count
2025-01-05T00:00:00Z 10234
2025-01-12T00:00:00Z 11587
2025-01-19T00:00:00Z 9876

This query bins each HTTP request to the start of its week and counts the total requests per week.

Track the weekly average span duration for each service.

Query

['otel-demo-traces']
| extend week_start = startofweek(_time)
| summarize avg_duration = avg(duration) by week_start, ['service.name']
| sort by week_start asc

Run in Playground

Output

week_start service.name avg_duration
2025-01-05T00:00:00Z frontend 00:00:01.2340000
2025-01-12T00:00:00Z frontend 00:00:01.1750000
2025-01-19T00:00:00Z frontend 00:00:01.2890000

This query groups trace spans by week and service, then calculates the average span duration for each combination.

Monitor weekly server error trends to detect weeks with unusual failure activity.

Query

['sample-http-logs']
| where toint(status) >= 500
| extend week_start = startofweek(_time)
| summarize error_count = count() by week_start
| sort by week_start asc

Run in Playground

Output

week_start error_count
2025-01-05T00:00:00Z 45
2025-01-12T00:00:00Z 67
2025-01-19T00:00:00Z 38

This query filters for server errors and counts them per week to reveal weekly error patterns.

  • endofweek: Returns the end of the week for a datetime value.
  • startofday: Returns the start of the day for a datetime value.
  • startofmonth: Returns the start of the month for a datetime value.
  • startofyear: Returns the start of the year for a datetime value.
  • week_of_year: Returns the ISO 8601 week number from a datetime value.

Other query languages#

Splunk SPL users

In Splunk SPL, you use relative_time with the @w0 snap-to modifier to round a timestamp to the start of the week (Sunday). In APL, the startofweek function achieves the same result and supports an optional week offset.

Splunk example

... | eval week_start=relative_time(_time, "@w0")

APL equivalent

... | extend week_start = startofweek(_time)
ANSI SQL users

In ANSI SQL, you use DATE_TRUNC('week', timestamp_column) to truncate a timestamp to the start of the week. Note that the start day of the week varies across SQL implementations. In APL, startofweek always uses Sunday as the start of the week.

SQL example

SELECT DATE_TRUNC('week', timestamp_column) AS week_start FROM events;

APL equivalent

['dataset']
| extend week_start = startofweek(_time)

Updated

Was this page helpful?