The parse_bytes function parses a string representation of data size (like 1 KB, 500 MB) and returns the numeric value in bytes. Use this function to convert human-readable byte strings from logs or configuration files into numeric values for calculations and comparisons.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically need custom eval expressions to parse byte strings. APL's parse_bytes provides this functionality natively.
['sample-http-logs']
| extend bytes = parse_bytes(size_str)In ANSI SQL, parsing byte strings requires complex CASE statements. APL's parse_bytes simplifies this operation.
['sample-http-logs']
| extend bytes = parse_bytes(size_str)Usage
Syntax
parse_bytes(bytes_string, base)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| bytes_string | string | Yes | A string representing a data size with units (for example, 1 KB, 500 MB, 2 GB). |
| base | int | No | Either 2 (default, 1024-based) or 10 (1000-based) for unit calculations. |
Returns
Returns the numeric value in bytes, or 0 if the string cannot be parsed.
Use case examples
Parse human-readable size strings to analyze and aggregate data transfer volumes.
Query
['sample-http-logs']
| extend size_bytes = parse_bytes('512 KB')
| where req_duration_ms > 3
| summarize total_bytes = sum(size_bytes), request_count = count() by status
| sort by total_bytes desc
| limit 10Output
| status | total_bytes | request_count |
|---|---|---|
| 200 | 4587520 | 8765 |
| 500 | 1048576 | 2341 |
| 404 | 524288 | 1234 |
This query parses size strings to calculate total data transfer by HTTP status code, enabling volume-based analysis of API usage.
Convert size strings from span attributes to numeric bytes for threshold-based analysis.
Query
['otel-demo-traces']
| extend payload_size = parse_bytes('256 KB', 2)
| where duration > 100ms
| summarize avg_size = avg(payload_size), span_count = count() by ['service.name']
| sort by avg_size desc
| limit 10Output
| service.name | avg_size | span_count |
|---|---|---|
| checkout | 262144 | 3421 |
| frontend | 262144 | 4532 |
| cart | 262144 | 2987 |
This query converts size strings to bytes for numeric analysis of payload sizes across different services.
List of related functions
- format_bytes: Formats numeric bytes as human-readable strings. Use this to reverse the parsing operation.
- strlen: Returns the length of a string. Use this when you need string length rather than byte parsing.