Use the isstring function to determine whether a value is of type string. This function is especially helpful when working with heterogeneous datasets where field types aren’t guaranteed, or when ingesting data from sources with loosely structured or mixed schemas.
You can use isstring to:
- Filter rows based on whether a field is a string.
- Validate and clean data before applying string functions.
- Avoid runtime errors in queries that expect specific data types.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, type checking is typically implicit and not exposed through a dedicated function like isstring. Instead, you often rely on function compatibility and casting behavior. In APL, isstring provides an explicit and reliable way to check if a value is a string before further processing.
['sample-http-logs']
| extend type=iff(isstring(status), 'string', 'not string')ANSI SQL doesn’t include a built-in IS STRING function. Instead, type checks usually rely on schema constraints, manual casting, or vendor-specific solutions. In contrast, APL offers isstring as a first-class function that returns a boolean indicating whether a value is of type string.
['sample-http-logs']
| extend type=iff(isstring(status), 'string', 'not string')Usage
Syntax
isstring(value)Parameters
| Name | Type | Description |
|---|---|---|
value |
any | The value to test for string type. |
Returns
A bool value that’s true if the input value is of type string, false otherwise.
Use case example
Use isstring to filter rows where the HTTP status code is a valid string.
Query
['sample-http-logs']
| extend is_string = isstring(status)
| where is_stringOutput
| _time | status | is_string |
|---|---|---|
| 2025-06-05T12:10:00Z | "404" | true |
This query filters out logs where the status field is stored as a string, which can help filter out ingestion issues or schema inconsistencies.