The array_rotate_left function in Axiom Processing Language (APL) rotates the elements of an array to the left by a specified number of positions. It’s useful when you want to reorder elements in a fixed-length array, shifting elements to the left while moving the leftmost elements to the end. For instance, this function can help analyze sequences where relative order matters but the starting position doesn’t, such as rotating network logs, error codes, or numeric arrays in data for pattern identification.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In APL, array_rotate_left allows for direct rotation within the array. Splunk SPL does not have a direct equivalent, so you may need to combine multiple SPL functions to achieve a similar rotation effect.
| eval rotated_array = mvindex(array, 1) . "," . mvindex(array, 0)
ANSI SQL lacks a direct equivalent for array rotation within arrays. A similar transformation can be achieved using array functions if available or by restructuring the array through custom logic.
SELECT array_column[2], array_column[3], array_column[0], array_column[1] FROM table

​
Usage

​
Syntax

array_rotate_left(array, positions)

​
Parameters

  • array: The array to be rotated. Use a dynamic data type.
  • positions: An integer specifying the number of positions to rotate the array to the left.

​
Returns

A new array where the elements have been rotated to the left by the specified number of positions.

​
Use case example

Analyze traces by rotating the field order for visualization or pattern matching. Query 
['otel-demo-traces']
| extend rotated_sequence = array_rotate_left(events, 1)
Run in Playground Output
events
[
  {
    "name": "Enqueued",
    "timestamp": 1733997117722909000
  },
  {
    "timestamp": 1733997117722911700,
    "name": "Sent"
  },
  {
    "name": "ResponseReceived",
    "timestamp": 1733997117723591400
  }
]
rotated_sequence
[
  {
    "timestamp": 1733997117722911700,
    "name": "Sent"
  },
  {
    "name": "ResponseReceived",
    "timestamp": 1733997117723591400
  },
  {
    "timestamp": 1733997117722909000,
    "name": "Enqueued"
  }
]
This example rotates trace-related fields, which can help to identify variations in trace data when visualized differently.