This page explains how to use the extend operator in APL.
extend
operator in APL allows you to create new calculated fields in your result set based on existing data. You can define expressions or functions to compute new values for each row, making extend
particularly useful when you need to enrich your data without altering the original dataset. You typically use extend
when you want to add additional fields to analyze trends, compare metrics, or generate new insights from your data.
Splunk SPL users
eval
command is used to create new fields or modify existing ones. In APL, you can achieve this using the extend
operator.ANSI SQL users
SELECT
clause with expressions to create new fields. In APL, extend
is used instead to define these new computed fields.NewField
: The name of the new field to be created.Expression
: The expression used to compute values for the new field. This can include mathematical operations, string manipulations, or functions.extend
that already exist in the input are removed and appended as their new calculated values.extend
that do not exist in the input are appended as their new calculated values.extend
to compute the duration of each request in seconds from a millisecond value.Query_time | req_duration_ms | id | status | uri | method | geo.city | geo.country | duration_sec |
---|---|---|---|---|---|---|---|---|
2024-10-17 09:00:01 | 300 | 1234 | 200 | /home | GET | London | UK | 0.3 |
req_duration_ms
field by 1000.