Use the isstring function to determine whether a value is of type string. This function is especially helpful when working with heterogeneous datasets where field types are not guaranteed, or when ingesting data from sources with loosely structured or mixed schemas. You can use isstring to:
  • Filter rows based on whether a field is a string.
  • Validate and clean data before applying string functions.
  • Avoid runtime errors in queries that expect specific data types.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, type checking is typically implicit and not exposed through a dedicated function like isstring. Instead, you often rely on function compatibility and casting behavior. In APL, isstring provides an explicit and reliable way to check if a value is a string before further processing.
| eval type=if(isstr(field), "string", "not string")
ANSI SQL does not include a built-in IS STRING function. Instead, type checks usually rely on schema constraints, manual casting, or vendor-specific solutions. In contrast, APL offers isstring as a first-class function that returns a boolean indicating whether a value is of type string.
SELECT
  CASE
    WHEN typeof(status) = 'VARCHAR' THEN 'string'
    ELSE 'not string'
  END AS type
FROM logs

​
Usage

​
Syntax

isstring(value)

​
Parameters

NameTypeDescription
valueanyThe value to test for string type.

​
Returns

A bool value that is true if the input value is of type string, false otherwise.

​
Use case example

Use isstring to filter rows where the HTTP status code is a valid string. Query 
['sample-http-logs']
| extend is_string = isstring(status)
| where is_string
Run in Playground Output
_timestatusis_string
2025-06-05T12:10:00Z”404”true
This query filters out logs where the status field is stored as a string, which can help filter out ingestion issues or schema inconsistencies.
  • ismap: Checks whether a value is of the dynamic type and represents a mapping.
  • isreal: Checks whether a value is a real number.