This page explains how to use the todynamic function in APL.
todynamic
function to parse a string as a dynamic value, such as a JSON object or array. This function is especially useful when your dataset contains structured data in string format and you want to access nested elements, iterate over arrays, or use dynamic-aware functions.
You often find todynamic
helpful when working with logs, telemetry, or security events that encode rich metadata or nested attributes in stringified JSON. By converting these strings into dynamic values, you can query, filter, and transform the nested fields using APL’s built-in support for dynamic types.
Splunk SPL users
todynamic
.ANSI SQL users
JSON_VALUE
, JSON_QUERY
, or CAST(... AS JSON)
to access structured content in string format. In APL, use todynamic
to convert a string to a dynamic value that supports dot notation and further manipulation.Name | Type | Description |
---|---|---|
value | string | A string representing a JSON-encoded object or array. |
null
.
_time | id |
---|---|
Jun 24, 09:28:10 | 2f2e5c40-1094-4237-a124-ec50fab7e726 |
Jun 24, 09:28:10 | 0f9724cb-fa9a-4a2f-bdf6-5c32b2f22efd |
Jun 24, 09:28:10 | a516c4e9-2ed9-4fb9-a191-94e2844e9b2a |
pack_array
when you don’t need named keys and want positional data instead.pack_dictionary
.pack_dictionary
.