extend

This page explains how to use the extend operator in APL.

The extend operator in APL allows you to create new calculated fields in your result set based on existing data. You can define expressions or functions to compute new values for each row, making extend particularly useful when you need to enrich your data without altering the original dataset. You typically use extend when you want to add additional fields to analyze trends, compare metrics, or generate new insights from your data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk, the eval command is used to create new fields or modify existing ones. In APL, you can achieve this using the extend operator.

ANSI SQL users

In ANSI SQL, you typically use the SELECT clause with expressions to create new fields. In APL, extend is used instead to define these new computed fields.

Usage

Syntax

| extend NewField = Expression

Parameters

• NewField: The name of the new field to be created.
• Expression: The expression used to compute values for the new field. This can include mathematical operations, string manipulations, or functions.

Returns

The operator returns a copy of the original dataset with the following changes:

• Field names noted by extend that already exist in the input are removed and appended as their new calculated values.
• Field names noted by extend that do not exist in the input are appended as their new calculated values.

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

In log analysis, you can use extend to compute the duration of each request in seconds from a millisecond value.

Query

['sample-http-logs'] 
| extend duration_sec = req_duration_ms / 1000

Run in Playground

Output

_time	req_duration_ms	id	status	uri	method	geo.city	geo.country	duration_sec
2024-10-17 09:00:01	300	1234	200	/home	GET	London	UK	0.3

This query calculates the duration of HTTP requests in seconds by dividing the req_duration_ms field by 1000.

List of related operators

• project: Use project to select specific fields or rename them. Unlike extend, it does not add new fields.
• summarize: Use summarize to aggregate data, which differs from extend that only adds new calculated fields without aggregation.