This page explains how to use the project operator in APL.
project
operator in Axiom Processing Language (APL) is used to select specific fields from a dataset, potentially renaming them or applying calculations on the fly. With project
, you can control which fields are returned by the query, allowing you to focus on only the data you need.
This operator is useful when you want to refine your query results by reducing the number of fields, renaming them, or deriving new fields based on existing data. It’s a powerful tool for filtering out unnecessary fields and performing light transformations on your dataset.
Splunk SPL users
project
operator is typically the table
or fields
command. While SPL’s table
focuses on selecting fields, fields
controls both selection and exclusion, similar to project
in APL.ANSI SQL users
SELECT
statement serves a similar role to the project
operator in APL. SQL users will recognize that project
behaves like selecting fields from a table, with the ability to rename or transform fields inline.FieldName
: The names of the fields in the order you want them to appear in the result set. If there is no Expression, then FieldName is compulsory and a field of that name must appear in the input.Expression
: Optional scalar expression referencing the input fields.project
operator returns a dataset containing only the specified fields.
_time | status | uri |
---|---|---|
2024-10-17 12:00:00 | 200 | /api/v1/getData |
2024-10-17 12:01:00 | 404 | /api/v1/getUser |
extend
to add new fields or calculate values without removing any existing fields.summarize
to aggregate data across groups of rows, which is useful when you’re calculating totals or averages.where
to filter rows based on conditions, often paired with project
to refine your dataset further.