The array_shift_right function in Axiom Processing Language (APL) shifts the elements of an array one position to the right. The last element of the array wraps around and becomes the first element. You can use this function to reorder elements, manage time-series data in circular arrays, or preprocess arrays for specific analytical needs.
When to use the function
- To manage and rotate data within arrays.
- To implement cyclic operations or transformations.
- To manipulate array data structures in log analysis or telemetry contexts.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, similar functionality might be achieved using custom code to rotate array elements, as there is no direct equivalent to array_shift_right. APL provides this functionality natively, making it easier to work with arrays directly.
['dataset.name']
| extend shifted_array = array_shift_right(array)ANSI SQL doesn’t have a built-in function for shifting arrays. In SQL, achieving this would involve user-defined functions or complex subqueries. In APL, array_shift_right simplifies this operation significantly.
['dataset.name']
| extend shifted_array = array_shift_right(array)Usage
Syntax
array_shift_right(array: array) : arrayParameters
| Parameter | Type | Description |
|---|---|---|
array |
array | The input array whose elements are shifted |
Returns
An array with its elements shifted one position to the right. The last element of the input array wraps around to the first position.
Use case example
Reorganize span events in telemetry data for visualization or debugging.
Query
['otel-demo-traces']
| take 50
| extend shifted_events = array_shift_right(events, 1)Output
[
{
"name": "Enqueued",
"timestamp": 1734001215487927300,
"attributes": null
},
{
"attributes": null,
"name": "Sent",
"timestamp": 1734001215487937000
},
{
"timestamp": 1734001215488191000,
"attributes": null,
"name": "ResponseReceived"
}
][
null,
{
"timestamp": 1734001215487927300,
"attributes": null,
"name": "Enqueued"
},
{
"attributes": null,
"name": "Sent",
"timestamp": 1734001215487937000
}
]The query rotates span events for better trace debugging.
List of related functions
- array_rotate_right: Rotates array elements to the right by a specified number of positions.
- array_rotate_left: Rotates elements of an array to the left.
- array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.