Use the tostring function to convert various data types to a string representation. This is helpful when you need to normalize values from different sources into string format for string operations, concatenation, or display purposes.
You typically use tostring when working with numeric values, booleans, or other types that need to be converted to strings for string manipulation, formatting, or when combining values in string operations.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk, you use tostring or tostring() function to convert values to strings. In APL, tostring provides similar functionality for converting various types to string format.
... | extend status_str = tostring(status_code)In standard SQL, you use CAST(... AS VARCHAR) or TO_CHAR functions to convert values to strings. In APL, tostring provides a simpler way to convert various types to string values.
['sample-http-logs']
| extend status_str = tostring(123)Usage
Syntax
tostring(value)Parameters
| Name | Type | Description |
|---|---|---|
| value | dynamic | The value to convert to string. |
Returns
If the expression value is non-null, the result is a string representation of the expression. If the expression value is null, the result is an empty string.
Conversion behavior
The tostring function converts values based on their type:
- Integer: Formatted as base-10 string.
- Float: Formatted using Go’s
FormatFloatfunction with precision-1. For more information, see the Go documentation. - Boolean: Returns
"true"or"false". Nil Boolean values return"false". - Duration: Returns duration-formatted strings. For example,
"1m20s". - Datetime: Returns RFC3339Nano formatted datetime string.
Use case example
Convert trace attributes to strings for string-based analysis and reporting.
Query
['otel-demo-traces']
| where isnotempty(['attributes.http.response.status_code'])
| extend status_str = tostring(['attributes.http.response.status_code'])
| extend duration_str = tostring(duration)
| extend trace_summary = strcat('Service: ', ['service.name'], ', Status: ', status_str, ', Duration: ', duration_str)
| project _time, trace_id, ['service.name'], status_str, trace_summaryOutput
| _time | trace_id | service.name | status_str | trace_summary |
|---|---|---|---|---|
| Jun 24, 09:28:10 | abc123 | frontend | 200 | Service: frontend, Status: 200, Duration: 150000000 |
This example converts trace attributes to strings and creates a summary message, enabling formatted trace reporting and analysis.
List of related functions
- strcat: Concatenates strings. Use
strcatwithtostringto combine converted values into formatted strings. - strcat-delim: Concatenates strings with a delimiter. Use
strcat-delimwithtostringto join converted values with separators. - toint: Converts input to integer. Use
tointto convert strings back to integers when needed.