This page explains how to use the getschema operator in APL.
getschema
operator in APL returns the schema of a dataset, including field names and their data types. You can use it to inspect the structure of a dataset before performing queries or transformations. This operator is useful when exploring new datasets, verifying data consistency, or debugging queries.
Splunk SPL users
fieldsummary
command to get schema-related information about a dataset. However, getschema
in APL is more direct and focused specifically on returning field names and types without additional summary statistics.ANSI SQL users
INFORMATION_SCHEMA
queries. APL’s getschema
operator provides a more straightforward way to get schema details without requiring system views.getschema
operator does not take any parameters.
Field | Type | Description |
---|---|---|
ColumnName | string | The name of the field in the dataset. |
ColumnOrdinal | number | The index number of the field in the dataset. |
ColumnType | string | The data type of the field. |
DataType | string | The APL-internal name for the data type of the field. |
getschema
to explore the schema of your log data before running queries.
Query
ColumnName | DataType | ColumnOrdinal | ColumnType |
---|---|---|---|
_sysTime | datetime | 0 | datetime |
_time | datetime | 1 | datetime |
content_type | string | 2 | string |
geo.city | string | 3 | string |
geo.country | string | 4 | string |
id | string | 5 | string |
project
to select specific fields instead of retrieving the entire schema.extend
to add new computed fields to your dataset after understanding the schema.summarize
for aggregations once you verify field types using getschema
.where
to filter datasets based on field values after checking their schema.order by
to sort datasets after verifying schema details.