The isarray function in APL checks whether a specified value is an array. Use this function to validate input data, handle dynamic schemas, or filter for records where a field is explicitly an array. It’s particularly useful when working with data that contains fields with mixed data types or optional nested arrays.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, similar functionality is achieved by analyzing the data structure manually, as SPL doesn’t have a direct equivalent to isarray. APL simplifies this task by providing the isarray function to directly evaluate whether a value is an array.
['dataset.name']
| extend is_array=isarray(field)In ANSI SQL, there is no built-in function for directly checking if a value is an array. You might need to rely on JSON functions or structural parsing. APL provides the isarray function as a more straightforward solution.
['dataset.name']
| extend is_array=isarray(field)Usage
Syntax
isarray(value)Parameters
| Parameter | Description |
|---|---|
value |
The value to check if it’s an array. |
Returns
A boolean value:
trueif the specified value is an array.falseotherwise.
Use case example
Filter for records where the events field contains an array.
Query
['otel-demo-traces']
| take 50
| summarize events_array = make_list(events)
| extend is_array = isarray(events_array)Output
| is_array |
|---|
| true |
List of related functions
- array_length: Returns the number of elements in an array.
- array_index_of: Finds the index of an element in an array.
- array_slice: Extracts a subset of elements from an array.