#Build an APL query

APL queries consist of the following:

• Data source: The most common data source is one of your Axiom datasets.
• Operators: Operators filter, manipulate, and summarize your data.

Delimit operators with the pipe character (|).

A typical APL query has the following structure:

DatasetName
| Operator ...
| Operator ...

• DatasetName is the name of the dataset you want to query.
• Operator is an operation you apply to the data.

#Example query

['github-issue-comment-event']
| extend isBot = actor contains '-bot' or actor contains '[bot]'
| where isBot == true
| summarize count() by bin_auto(_time), actor

Run in Playground

The query above uses a dataset called github-issue-comment-event as its data source. It uses the following operators:

• extend adds a new field isBot to the query results. It sets the values of the new field to true if the values of the actor field in the original dataset contain -bot or [bot].
• where filters for the values of the isBot field. It only returns rows where the value is true.
• summarize aggregates the data and produces a chart.

Each operator is separated using the pipe character (|).

#Example result

As a result, the query returns a chart and a table. The table counts the different values of the actor field where isBot is true, and the chart displays the distribution of these counts over time.

#Quote dataset and field names

If the name of a dataset or field contains at least one of the following special characters, quote the name in your APL query: - Space ( ) - Dot (.) - Dash (-)

To quote the dataset or field in your APL query, enclose its name with quotation marks (' or ") and square brackets ([]). For example, ['my-field'].

For more information on rules about naming and quoting entities, see Entity names.

#What’s next

Check out the list of example queries or explore the supported operators and functions:

• Scalar functions
• Aggregation functions
• Tabular operators
• Scalar operators