array_length

Usage#

Syntax#

array_length(array_expression)

Parameters#

array_expression: An expression representing the array to measure.

Returns#

The function returns an integer representing the number of elements in the specified array.

Use case example#

In OpenTelemetry traces, array_length can reveal the number of events associated with a span.

Query

['otel-demo-traces']
| take 50
| extend event_count = array_length(events)
| where event_count > 2

Run in Playground

Output

_time	trace_id	span_id	service.name	event_count
2024-10-28T12:30:00	trace_abc123	span_001	frontend	3

This query finds spans associated with at least three events.

array_slice: Extracts a subset of elements from an array.
array_concat: Combines multiple arrays.
array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.

Other query languages#

Splunk SPL users

In Splunk SPL, you might use the mvcount function to determine the length of a multivalue field. In APL, array_length serves the same purpose by returning the size of an array within a column.

Splunk example

| eval array_size = mvcount(array_field)

APL equivalent

['sample-http-logs']
| extend array_size = array_length(array_field)

ANSI SQL users

In ANSI SQL, you would use functions such as CARDINALITY or ARRAY_LENGTH (in databases that support arrays) to get the length of an array. In APL, the array_length function is straightforward and works directly with array fields in any dataset.

SQL example

SELECT CARDINALITY(array_field) AS array_size
FROM sample_table