This page explains how to use the bag_pack and pack functions in APL.
bag_pack
function in APL to construct a dynamic property bag from a list of key-value pairs. A property bag is a flexible data structure where keys are strings and values are dynamic types. This function is useful when you want to combine multiple values into a single dynamic object, often to simplify downstream processing or export.
You typically use bag_pack
in projection scenarios to consolidate structured data—for example, packing related request metadata into one field, or grouping trace data by contextual attributes. This makes it easier to output, filter, or transform nested information.
pack
and bag_pack
functions are equivalent in APL.A common use is bag_pack(*)
that gets all fields of your dataset as a bag. This can be useful when you want to get sets of values.Splunk SPL users
mvzip
and eval
to create key-value mappings, or use spath
to interpret JSON data. However, packing data into a true key-value structure for export or downstream use requires JSON manipulation. APL’s bag_pack
provides a native and type-safe way to do this.ANSI SQL users
bag_pack
. To achieve similar behavior, you typically construct JSON objects using functions like JSON_OBJECT
or use user-defined types. In APL, bag_pack
is the idiomatic way to construct dynamic objects with labeled fields.Name | Type | Description |
---|---|---|
key1, key2, ... | string | The names of the fields to include in the property bag. |
value1, value2, ... | scalar | The corresponding values for the keys. Values can be of any scalar type. |
dynamic
value representing a property bag (dictionary) where keys are strings and values are the corresponding values.
bag_pack
to create a structured object that captures key request attributes for easier inspection or export.Query_time | error_context |
---|---|
2025-05-27T10:00:00Z | { "uri": "/api/data", "method": "GET", "duration_ms": 342 } |
2025-05-27T10:05:00Z | { "uri": "/api/auth", "method": "POST", "duration_ms": 879 } |
error_context
.