Use the array_reverse function in APL to reverse the order of elements in an array. This function is useful when you need to transform data where the sequence matters, such as reversing a list of events for chronological analysis or processing lists in descending order.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk, reversing an array is not a built-in function, so you typically manipulate the data manually or use workarounds. In APL, array_reverse simplifies this process by reversing the array directly.
# SPL does not have a direct array_reverse equivalent.
Standard ANSI SQL lacks an explicit function to reverse an array; you generally need to create a custom solution. APL’s array_reverse makes reversing an array straightforward.
-- ANSI SQL lacks a built-in array reverse function.

Usage

Syntax

array_reverse(array_expression)

Parameters

  • array_expression: The array you want to reverse. This array must be of a dynamic type.

Returns

Returns the input array with its elements in reverse order.

Use case examples

Use array_reverse to inspect the sequence of actions in log entries, reversing the order to understand the initial steps of a user’s session.Query
['sample-http-logs']
| summarize paths = make_list(uri) by id
| project id, reversed_paths = array_reverse(paths)
Run in PlaygroundOutput
idreversed_paths
U1234[‘/home’, ‘/cart’, ‘/product’, ’/‘]
U5678[‘/login’, ‘/search’, ’/’]
This example identifies a user’s navigation sequence in reverse, showing their entry point into the system.
  • array_length: Returns the number of elements in an array.
  • array_shift_right: Shifts array elements to the right.
  • array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.