Add 4 set functions and 3 unixtime functions

apl/scalar-functions/datetime-functions.mdx

@@ -20,19 +20,22 @@ The table summarizes the datetime functions available in APL.
 | [endofyear](#endofyear)         | Returns the end of the year containing the date                                                                      |
 | [getmonth](#getmonth)           | Get the month number (1-12) from a datetime.                                                                         |
 | [getyear](#getyear)             | Returns the year part of the `datetime` argument.                                                                    |
-| [hourofday](#hourofday)         | Returns the integer number representing the hour number of the given date                                            |
-| [endofday](#endofday)           | Returns the end of the day containing the date                                                                       |
+| [hourofday](#hourofday)         | Returns the integer number representing the hour number of the given date.                                            |
+| [endofday](#endofday)           | Returns the end of the day containing the date.                                                                       |
 | [now](#now)                     | Returns the current UTC clock time, optionally offset by a given timespan.                                           |
-| [endofmonth](#endofmonth)       | Returns the end of the month containing the date                                                                     |
+| [endofmonth](#endofmonth)       | Returns the end of the month containing the date.                                                                     |
 | [endofweek](#endofweek)         | Returns the end of the week containing the date.                                                                     |
 | [monthofyear](#monthofyear)     | Returns the integer number represents the month number of the given year.                                            |
-| [startofday](#startofday)       | Returns the start of the day containing the date                                                                     |
-| [startofmonth](#startofmonth)   | Returns the start of the month containing the date                                                                   |
-| [startofweek](#startofweek)     | Returns the start of the week containing the date                                                                    |
-| [startofyear](#startofyear)     | Returns the start of the year containing the date                                                                    |
-| [unixtime_seconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime)     | Converts a Unix timestamp to an APL `datetime` value.                                                                    |
-
-- We support the ISO 8601 format, which is the standard format for representing dates and times in the Gregorian calendar. [Check them out here](/apl/data-types/scalar-data-types#supported-formats)
+| [startofday](#startofday)       | Returns the start of the day containing the date.                                                                     |
+| [startofmonth](#startofmonth)   | Returns the start of the month containing the date.                                                                   |
+| [startofweek](#startofweek)     | Returns the start of the week containing the date.                                                                    |
+| [startofyear](#startofyear)     | Returns the start of the year containing the date.                                                                    |
+| [unixtime_microseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-microseconds-todatetime)     | Converts a Unix timestamp expressed in whole microseconds to an APL `datetime` value.                              |
+| [unixtime_milliseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-milliseconds-todatetime)     | Converts a Unix timestamp expressed in whole milliseconds to an APL `datetime` value.                                   |
+| [unixtime_nanoseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-nanoseconds-todatetime)     | Converts a Unix timestamp expressed in whole nanoseconds to an APL `datetime` value.                                   |
+| [unixtime_seconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime)     | Converts a Unix timestamp expressed in whole seconds to an APL `datetime` value.                                            |
+
+We support the ISO 8601 format, which is the standard format for representing dates and times in the Gregorian calendar. [Check them out here](/apl/data-types/scalar-data-types#supported-formats)
 
 ## ago
 

apl/scalar-functions/datetime-functions/unixtime-microseconds-todatetime.mdx

@@ -0,0 +1,97 @@
+---
+title: unixtime_microseconds_todatetime
+description: 'This page explains how to use the unixtime_microseconds_todatetime function in APL.'
+---
+
+`unixtime_microseconds_todatetime` converts a Unix timestamp that is expressed in whole microseconds since 1970-01-01 00:00:00 UTC to an APL `datetime` value.
+
+Use the function whenever you ingest data that stores time as epoch microseconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to `datetime` lets you bin, filter, and visualize events with the rest of your time-series data.
+
+## For users of other query languages
+
+If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
+
+<AccordionGroup>
+<Accordion title="Splunk SPL users">
+
+In Splunk, you often convert epoch values with `eval ts=strftime(_time,"%Y-%m-%dT%H:%M:%S.%6N")`. In APL, the conversion happens with a scalar function, so you can use it inline wherever a `datetime` literal is accepted.
+
+<CodeGroup>
+
+```sql Splunk example
+| eval eventTime=strftime( micro_ts/1000000 , "%Y-%m-%dT%H:%M:%S.%6N")
+````
+
+```kusto APL equivalent
+| extend eventTime = unixtime_microseconds_todatetime(micro_ts)
+```
+
+</CodeGroup>
+
+</Accordion>
+<Accordion title="ANSI SQL users">
+
+Standard SQL engines rarely expose microsecond-epoch helpers. You usually cast or divide by 1,000,000 and add an interval. APL gives you a dedicated scalar function that returns a native `datetime`, which then supports the full date-time syntax.
+
+<CodeGroup>
+
+```sql SQL example
+SELECT TIMESTAMP '1970-01-01 00:00:00' + micro_ts / 1000000 * INTERVAL '1 second' FROM events;
+```
+
+```kusto APL equivalent
+['events']
+| extend eventTime = unixtime_microseconds_todatetime(micro_ts)
+```
+
+</CodeGroup>
+
+</Accordion>
+</AccordionGroup>
+
+## Usage
+
+### Syntax
+
+```kusto
+unixtime_microseconds_todatetime(microseconds)
+```
+
+### Parameters
+
+| Name      | Type            | Description                                                        |
+| --------- | --------------- | ------------------------------------------------------------------ |
+| `microseconds` | `int` or `long` | Whole microseconds since the Unix epoch. Fractional input is truncated. |
+
+### Returns
+
+A `datetime` value that represents the given epoch microseconds at UTC precision (1 microsecond).
+
+## Use case example
+
+The HTTP access logs keep the timestamp as epoch microseconds and you want to convert the values to datetime.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| extend epoch_microseconds = toint(datetime_diff('Microsecond', _time, datetime(1970-01-01)))
+| extend datetime_standard = unixtime_microseconds_todatetime(epoch_microseconds)
+| project _time, epoch_microseconds, datetime_standard
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20epoch_microseconds%20%3D%20toint(datetime_diff('Microsecond'%2C%20_time%2C%20datetime(1970-01-01)))%20%7C%20extend%20datetime_standard%20%3D%20unixtime_microseconds_todatetime(epoch_microseconds)%20%7C%20project%20_time%2C%20epoch_microseconds%2C%20datetime_standard%22%7D)
+
+**Output**
+
+| _time            | epoch_microseconds        | datetime_standard           |
+|------------------|----------------------|-----------------------------|
+| May 15, 12:09:22 | 1,747,303,762    | 2025-05-15T10:09:22Z    |
+
+This query converts the timestamp to epoch microseconds and then back to datetime for demonstration purposes.
+
+## List of related functions
+
+- [unixtime_milliseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-milliseconds-todatetime): Converts a Unix timestamp expressed in whole milliseconds to an APL `datetime` value.
+- [unixtime_nanoseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-nanoseconds-todatetime): Converts a Unix timestamp expressed in whole nanoseconds to an APL `datetime` value.
+- [unixtime_seconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime): Converts a Unix timestamp expressed in whole seconds to an APL `datetime` value.

apl/scalar-functions/datetime-functions/unixtime-milliseconds-todatetime.mdx

@@ -0,0 +1,97 @@
+---
+title: unixtime_milliseconds_todatetime
+description: 'This page explains how to use the unixtime_milliseconds_todatetime function in APL.'
+---
+
+`unixtime_milliseconds_todatetime` converts a Unix timestamp that is expressed in whole milliseconds since 1970-01-01 00:00:00 UTC to an APL `datetime` value.
+
+Use the function whenever you ingest data that stores time as epoch milliseconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to `datetime` lets you bin, filter, and visualize events with the rest of your time-series data.
+
+## For users of other query languages
+
+If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
+
+<AccordionGroup>
+<Accordion title="Splunk SPL users">
+
+`unixtime_milliseconds_todatetime()` corresponds to an `eval` expression that divides the epoch value by 1000 and formats the result. You skip both steps in APL because the function takes milliseconds directly.
+
+<CodeGroup>
+
+```sql Splunk example
+| eval timestamp=strftime(epoch_ms/1000,"%Y-%m-%dT%H:%M:%SZ")
+````
+
+```kusto APL equivalent
+| extend timestamp=unixtime_milliseconds_todatetime(epoch_ms)
+```
+
+</CodeGroup>
+
+</Accordion>
+<Accordion title="ANSI SQL users">
+
+The function plays the same role as `FROM_UNIXTIME()` or `TO_TIMESTAMP()` in SQL dialects. In APL, you don’t divide by 1,000 because the function expects milliseconds.
+
+<CodeGroup>
+
+```sql SQL example
+SELECT FROM_UNIXTIME(epoch_ms/1000) AS timestamp FROM requests;
+```
+
+```kusto APL equivalent
+['sample-http-logs']
+| extend timestamp=unixtime_milliseconds_todatetime(epoch_ms)
+```
+
+</CodeGroup>
+
+</Accordion>
+</AccordionGroup>
+
+## Usage
+
+### Syntax
+
+```kusto
+unixtime_milliseconds_todatetime(milliseconds)
+```
+
+### Parameters
+
+| Name      | Type            | Description                                                        |
+| --------- | --------------- | ------------------------------------------------------------------ |
+| `milliseconds` | `int` or `long` | Whole milliseconds since the Unix epoch. Fractional input is truncated. |
+
+### Returns
+
+A `datetime` value that represents the given epoch milliseconds at UTC precision (1 millisecond).
+
+## Use case example
+
+The HTTP access logs keep the timestamp as epoch milliseconds and you want to convert the values to datetime.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| extend epoch_milliseconds = toint(datetime_diff('Millisecond', _time, datetime(1970-01-01)))
+| extend datetime_standard = unixtime_milliseconds_todatetime(epoch_milliseconds)
+| project _time, epoch_milliseconds, datetime_standard
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20epoch_milliseconds%20%3D%20toint(datetime_diff('Millisecond'%2C%20_time%2C%20datetime(1970-01-01)))%20%7C%20extend%20datetime_standard%20%3D%20unixtime_milliseconds_todatetime(epoch_milliseconds)%20%7C%20project%20_time%2C%20epoch_milliseconds%2C%20datetime_standard%22%7D)
+
+**Output**
+
+| _time            | epoch_milliseconds        | datetime_standard           |
+|------------------|----------------------|-----------------------------|
+| May 15, 12:09:22 | 1,747,303,762    | 2025-05-15T10:09:22Z    |
+
+This query converts the timestamp to epoch milliseconds and then back to datetime for demonstration purposes.
+
+## List of related functions
+
+- [unixtime_microseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-microseconds-todatetime): Converts a Unix timestamp expressed in whole microseconds to an APL `datetime` value.
+- [unixtime_nanoseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-nanoseconds-todatetime): Converts a Unix timestamp expressed in whole nanoseconds to an APL `datetime` value.
+- [unixtime_seconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime): Converts a Unix timestamp expressed in whole seconds to an APL `datetime` value.

apl/scalar-functions/datetime-functions/unixtime-nanoseconds-todatetime.mdx

@@ -0,0 +1,98 @@
+---
+title: unixtime_nanoseconds_todatetime
+description: 'This page explains how to use the unixtime_nanoseconds_todatetime function in APL.'
+---
+
+`unixtime_nanoseconds_todatetime` converts a Unix timestamp that is expressed in whole nanoseconds since 1970-01-01 00:00:00 UTC to an APL `datetime` value.
+
+Use the function whenever you ingest data that stores time as epoch nanoseconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to `datetime` lets you bin, filter, and visualize events with the rest of your time-series data.
+
+## For users of other query languages
+
+If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
+
+<AccordionGroup>
+<Accordion title="Splunk SPL users">
+
+    Splunk SPL usually stores `_time` in seconds and uses functions such as `strftime` or `strptime` for conversion. In APL, you pass the nanosecond integer directly to `unixtime_nanoseconds_todatetime`, so you don’t divide by 1,000,000,000 first.
+
+<CodeGroup>
+
+```sql Splunk example
+| eval event_time = strftime(epoch_ns/1000000000, "%Y-%m-%dT%H:%M:%S.%N%z")
+````
+
+```kusto APL equivalent
+| extend event_time = unixtime_nanoseconds_todatetime(epoch_ns)
+```
+
+</CodeGroup>
+
+</Accordion>
+<Accordion title="ANSI SQL users">
+
+Many SQL engines use `TO_TIMESTAMP_LTZ()` or similar functions that expect seconds or microseconds. In APL, you pass the nanosecond value directly, and the function returns a `datetime` (UTC).
+
+<CodeGroup>
+
+```sql SQL example
+SELECT TO_TIMESTAMP_LTZ(epoch_ns/1e9) AS event_time
+FROM   events;
+```
+
+```kusto APL equivalent
+events
+| extend event_time = unixtime_nanoseconds_todatetime(epoch_ns)
+```
+
+</CodeGroup>
+
+</Accordion>
+</AccordionGroup>
+
+## Usage
+
+### Syntax
+
+```kusto
+unixtime_nanoseconds_todatetime(nanoseconds)
+```
+
+### Parameters
+
+| Name      | Type            | Description                                                        |
+| --------- | --------------- | ------------------------------------------------------------------ |
+| `nanoseconds` | `int` or `long` | Whole nanoseconds since the Unix epoch. Fractional input is truncated. |
+
+### Returns
+
+A `datetime` value that represents the given epoch nanoseconds at UTC precision (1 nanosecond).
+
+## Use case example
+
+The HTTP access logs keep the timestamp as epoch nanoseconds and you want to convert the values to datetime.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| extend epoch_nanoseconds = toint(datetime_diff('Nanosecond', _time, datetime(1970-01-01)))
+| extend datetime_standard = unixtime_nanoseconds_todatetime(epoch_nanoseconds)
+| project _time, epoch_nanoseconds, datetime_standard
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20epoch_nanoseconds%20%3D%20toint(datetime_diff('Nanosecond'%2C%20_time%2C%20datetime(1970-01-01)))%20%7C%20extend%20datetime_standard%20%3D%20unixtime_nanoseconds_todatetime(epoch_nanoseconds)%20%7C%20project%20_time%2C%20epoch_nanoseconds%2C%20datetime_standard%22%7D)
+
+**Output**
+
+| _time            | epoch_nanoseconds        | datetime_standard           |
+|------------------|----------------------|-----------------------------|
+| May 15, 12:09:22 | 1,747,303,762    | 2025-05-15T10:09:22Z    |
+
+This query converts the timestamp to epoch nanoseconds and then back to datetime for demonstration purposes.
+
+## List of related functions
+
+- [unixtime_microseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-microseconds-todatetime): Converts a Unix timestamp expressed in whole microseconds to an APL `datetime` value.
+- [unixtime_milliseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-milliseconds-todatetime): Converts a Unix timestamp expressed in whole milliseconds to an APL `datetime` value.
+- [unixtime_seconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime): Converts a Unix timestamp expressed in whole seconds to an APL `datetime` value.

apl/scalar-functions/datetime-functions/unixtime-seconds-todatetime.mdx

@@ -19,12 +19,11 @@ If you come from other query languages, this section explains how to adjust your
 <CodeGroup>
 
 ```sql Splunk example
-... | eval event_time = strftime(epoch, "%Y-%m-%dT%H:%M:%S")
+eval event_time = strftime(epoch, "%Y-%m-%dT%H:%M:%S")
 ````
 
 ```kusto APL equivalent
-... 
-| extend event_time = unixtime_seconds_todatetime(epoch)
+extend event_time = unixtime_seconds_todatetime(epoch)
 ```
 
 </CodeGroup>
@@ -90,3 +89,9 @@ The HTTP access logs keep the timestamp as epoch seconds and you want to convert
 | May 15, 12:09:22 | 1,747,303,762    | 2025-05-15T10:09:22Z    |
 
 This query converts the timestamp to epoch seconds and then back to datetime for demonstration purposes.
+
+## List of related functions
+
+- [unixtime_microseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-microseconds-todatetime): Converts a Unix timestamp expressed in whole microseconds to an APL `datetime` value.
+- [unixtime_milliseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-milliseconds-todatetime): Converts a Unix timestamp expressed in whole milliseconds to an APL `datetime` value.
+- [unixtime_nanoseconds_todatetime](/apl/scalar-functions/datetime-functions/unixtime-nanoseconds-todatetime): Converts a Unix timestamp expressed in whole nanoseconds to an APL `datetime` value.