NRQL: Facet results by time

With NRQL, you can create queries that group results across time. For example, you can group results together based on timestamps by separating them into buckets that cover a specified range of dates and times.

When using the time functions from the table below in NRQL queries, the results return in UTC. To adjust the results to your time zone, include the WITH TIMEZONE clause in your query.

For the functions that have an optional format parameter, the accepted values are string and numeric. The default format value will be a string if omitted.

Time-based function	Description	String format	Numeric format
`yearOf(attr [, format])`	Returns the year of a timestamp.	`2023`	`2023`
`quarterOf(attr [, format])`	Returns the quarter of the year. The returned value includes both the quarter and the year when formatted as a string.	`Q1 2014`	`1`
`monthOf(attr [, format])`	Returns the month and year of the timestamp when formatted as a string, or the numeric month when formatted as a number.	`July 2014`	`7`
`weekOf(attr)`	Returns the week the timestamp occurred by naming the month and day of that week's Monday.	`Week of January 15`	N/A
`weekdayOf(attr [, format])`	Returns the day of the week of the timestamp. The returned value loops back at the end of the week, allowing you to look at trends by weekday over time.	`Sunday`	`0`
`dateOf(attr)`	Returns the date of the timestamp. The returned value includes month, day and year.	`July 15, 2014`	N/A
`dayOfMonthOf(attr [, format])`	Returns the numeric date within a single month of the timestamp, a value from 1 to 31. The returned value does not include the month.	`23`	`23`
`daysInMonthOf(attr [, format])`	Returns the number of days in the month of the timestamp.	`30`	`30`
`hourOf(attr [, format])`	Returns the hour of the timestamp. The returned value does not include a prepended 0 for hours between 1am and 9am. This differs from functions and clauses such as `SINCE`, which accept these hours with a 0 at the start.	`6:00`, `12:00`, `18:00`	`6`, `12`, `18`
`minuteOf(attr [, format])`	Returns the minute of the timestamp. The returned value does not include a prepended 0 for minutes between 1 and 9. This differs from functions and clauses such as `SINCE`, which accept these minutes with a 0 at the start.	`0`, `6`, `48`	`0`, `6`, `48`

Facet your NRQL query time range

Tip

In these examples, we use a custom timestamp attribute submitted with PageView events called createdAt. To facet by the time of PageView event ingestion, you could use the timestamp attribute instead.

To create your NRQL query, use a FACET clause with a bucket function that works with a timestamp attribute. Run a standard FACET query, but instead of faceting by an attribute, facet by time. For example:

SELECT count(*) FROM K8sDaemonsetSample FACET monthOf(createdAt)

A screenshot displaying a NRQL query faceted by time

To perform multiple functions within the same query, use NRQL's multi-facet capability:

SELECT count(*) FROM K8sDaemonsetSample FACET dateOf(createdAt), monthOf(createdAt)

Many time-based functions accept an optional second argument of either string (the default) or numeric, which controls the format of the result value.

SELECT count(*) FROM K8sDaemonsetSample FACET monthOf(createdAt, numeric)

To group all results based on the month, use the monthOf function. In this example, the NRQL query includes a function (count(*)), a data type, a time frame (SINCE 1 day ago), and a time facet (monthOf(createdAt)).

SELECT count(*) FROM K8sDaemonsetSample SINCE 1 day ago FACET monthOf(createdAt)

Running the query returns a table of results by month.

You need to be aware of UNTIL you add the TIMESERIES function and use the time function in a time series chart.

The default value of UNTIL is NOW, so if you do not specify anything, the values of the time functions may be separated or combined.

By specifying UNTIL today, you can create a chart that ends at 12:00 AM on the same day.

SELECT count(*) FROM PageView TIMESERIES 1 day WITH TIMEZONE 'Europe/London' SINCE 4 week ago UNTIL today

If you want to visualize data from last month instead of the past four weeks, you can use SINCE last month UNTIL this month.

SELECT count(*) FROM PageView TIMESERIES 1 day  WITH TIMEZONE 'Europe/London' SINCE last month UNTIL this month

Facet your NRQL query time range

Tip

Facet examples

Group results by month

Other grouping examples with FACET clause

Example of creating a chart by specifying TIMESERIES

NRQL: Facet results by time

Facet your NRQL query time range .css-21sua1{background:none;border:none;width:0;padding:0;}

Tip

Facet examples

Other grouping examples with FACET clause

Example of creating a chart by specifying TIMESERIES

Facet your NRQL query time range