This page explains how to use the project-keep operator function in APL.
project-keep
operator in APL is a powerful tool for field selection. It allows you to explicitly keep specific fields from a dataset, discarding any others not listed in the operator’s parameters. This is useful when you only need to work with a subset of fields in your query results and want to reduce clutter or improve performance by eliminating unnecessary fields.
You can use project-keep
when you need to focus on particular data points, such as in log analysis, security event monitoring, or extracting key fields from traces.
Splunk SPL users
table
command performs a similar task to APL’s project-keep
. It selects only the fields you specify and excludes any others.ANSI SQL users
SELECT
statement combined with field names performs a task similar to project-keep
in APL. Both allow you to specify which fields to retrieve from the dataset.FieldName
: The field you want to keep in the result set.project-keep
returns a dataset with only the specified fields. All other fields are removed from the output. The result contains the same number of rows as the input table.
_time | status | uri | method | req_duration_ms |
---|---|---|---|---|
2024-10-17 10:00:00 | 200 | /index.html | GET | 120 |
2024-10-17 10:01:00 | 404 | /non-existent.html | GET | 50 |
2024-10-17 10:02:00 | 500 | /server-error | POST | 300 |
project
to explicitly specify the fields you want in your result, while also allowing transformations or calculations on those fields.extend
to add new fields or modify existing ones without dropping any fields.summarize
when you need to perform aggregation operations on your dataset, grouping data as necessary.data*
or ['data.fo']*
.
Here’s how you can use wildcards in project-keep
: