toarray

This page explains how to use the toarray function in APL.

Use the toarray function in APL to convert a dynamic-typed input—such as a bag, property bag, or JSON array—into a regular array. This is helpful when you want to process the elements individually with array functions like array_length, array_index_of, or mv-expand.

You typically use toarray when working with semi-structured data, especially after parsing JSON from log fields or external sources. It lets you access and manipulate nested collections using standard array operations.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk, multivalue fields are native, and many SPL commands like mvexpand, mvindex, and mvcount operate directly on them. In APL, dynamic fields can also contain multivalue data, but you need to explicitly convert them to arrays using toarray before applying array functions.

Splunk example

... | eval methods=split("GET,POST,PUT", ",") | mvcount(methods)

ANSI SQL users

ANSI SQL does not support arrays natively. You typically store lists as JSON and use JSON functions to manipulate them. In APL, you can parse JSON into dynamic values and use toarray to convert those into arrays for further processing.

SQL example

SELECT JSON_ARRAY_LENGTH('["GET","POST","PUT"]')

Usage

Syntax

toarray(value)

Parameters

Name	Type	Description
value	dynamic	A JSON array, property bag, or bag value

Returns

An array containing the elements of the dynamic input. If the input is already an array, the result is identical. If the input is a property bag, it returns an array of values. If the input is not coercible to an array, the result is an empty array.

Example

You want to convert a string to an array because you want to pass the result to a function that accepts arrays, such as array_concat.

Query

['otel-demo-traces']
| extend service_list = toarray('123')
| extend json_list = parse_json('["frontend", "cartservice", "checkoutservice"]')
| extend combined_list = array_concat(service_list, json_list)
| project _time, combined_list

Run in Playground

Output

_time	combined_list
Jun 24, 09:28:10	[“123”, “frontend”, “cartservice”, “checkoutservice”]
Jun 24, 09:28:10	[“123”, “frontend”, “cartservice”, “checkoutservice”]
Jun 24, 09:28:10	[“123”, “frontend”, “cartservice”, “checkoutservice”]

List of related functions

• array_length: Returns the number of elements in an array. Useful before applying array_extract.
• array_index_of: Finds the position of an element in an array, which can help set the startIndex for array_extract.
• pack_array: Use this to combine scalar values into an array. Use pack_array when you don’t need named keys and want positional data instead.
• bag_keys: Returns the list of keys in a dynamic dictionary. Use this to inspect or filter contents created by pack_dictionary.
• bag_pack: Expands a dictionary into multiple columns. Use it to revert the packing performed by pack_dictionary.