This page explains how to use the ismap function in APL.
ismap
function in APL to check whether a value is of the dynamic
type and represents a mapping (also known as a dictionary, associative array, property bag, or object). A mapping consists of key-value pairs where keys are strings and values can be of any type. This function is especially useful when working with semi-structured data, such as logs or telemetry traces, where fields might dynamically contain arrays, objects, or scalar values.
Use ismap
to:
Splunk SPL users
ismap
, but you might perform similar validations using typeof
checks or custom functions in eval
.ANSI SQL users
jsonb
, BigQuery with STRUCT
, or Snowflake), you can simulate map checks using type inspection or schema introspection.Name | Type | Description |
---|---|---|
value | any | The value to check for being a map. |
true
if the value is a mapping (dictionary), otherwise returns false
.
ismap
to find log entries where a dynamic field contains structured key-value pairs, such as metadata attached to HTTP requests.
Query
_time | is_structured |
---|---|
2025-06-06T08:00:00Z | true |