This page explains how to use the toarray function in APL.
toarray
function in APL to convert a dynamic-typed input—such as a bag, property bag, or JSON array—into a regular array. This is helpful when you want to process the elements individually with array functions like array_length
, array_index_of
, or mv-expand
.
You typically use toarray
when working with semi-structured data, especially after parsing JSON from log fields or external sources. It lets you access and manipulate nested collections using standard array operations.
Splunk SPL users
mvexpand
, mvindex
, and mvcount
operate directly on them. In APL, dynamic fields can also contain multivalue data, but you need to explicitly convert them to arrays using toarray
before applying array functions.ANSI SQL users
toarray
to convert those into arrays for further processing.Name | Type | Description |
---|---|---|
value | dynamic | A JSON array, property bag, or bag value |
array_concat
.
Query
_time | combined_list |
---|---|
Jun 24, 09:28:10 | [“123”, “frontend”, “cartservice”, “checkoutservice”] |
Jun 24, 09:28:10 | [“123”, “frontend”, “cartservice”, “checkoutservice”] |
Jun 24, 09:28:10 | [“123”, “frontend”, “cartservice”, “checkoutservice”] |
array_extract
.startIndex
for array_extract
.pack_array
when you don’t need named keys and want positional data instead.pack_dictionary
.pack_dictionary
.