array_reverse
Usage#
Syntax#
array_reverse(array_expression)Parameters#
array_expression: The array you want to reverse. This array must be of a dynamic type.
Returns#
Returns the input array with its elements in reverse order.
Use case examples#
Use array_reverse to inspect the sequence of actions in log entries, reversing the order to understand the initial steps of a user's session.
Query
['sample-http-logs']
| summarize paths = make_list(uri) by id
| project id, reversed_paths = array_reverse(paths)Output
| id | reversed_paths |
|---|---|
| U1234 | ['/home', '/cart', '/product', '/'] |
| U5678 | ['/login', '/search', '/'] |
This example identifies a user’s navigation sequence in reverse, showing their entry point into the system.
Use array_reverse to analyze trace data by reversing the sequence of span events for each trace, allowing you to trace back the sequence of service calls.
Query
['otel-demo-traces']
| summarize spans = make_list(span_id) by trace_id
| project trace_id, reversed_spans = array_reverse(spans)Output
| trace_id | reversed_spans |
|---|---|
| T12345 | ['S4', 'S3', 'S2', 'S1'] |
| T67890 | ['S7', 'S6', 'S5'] |
This example reveals the order in which service calls were made in a trace, but in reverse, aiding in backtracking issues.
Apply array_reverse to examine security events, like login attempts or permission checks, in reverse order to identify unusual access patterns or last actions.
Query
['sample-http-logs']
| where status == '403'
| summarize blocked_uris = make_list(uri) by id
| project id, reversed_blocked_uris = array_reverse(blocked_uris)Output
| id | reversed_blocked_uris |
|---|---|
| U1234 | ['/admin', '/settings', '/login'] |
| U5678 | ['/account', '/dashboard', '/login'] |
This example helps identify the sequence of unauthorized access attempts by each user.
List of related functions#
- array_length: Returns the number of elements in an array.
- array_shift_right: Shifts array elements to the right.
- array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.
Other query languages#
Splunk SPL users
In Splunk, reversing an array isn’t a built-in function, so you typically manipulate the data manually or use workarounds. In APL, array_reverse simplifies this process by reversing the array directly.
Splunk example
# SPL doesn’t have a direct array_reverse equivalent.APL equivalent
let arr = dynamic([1, 2, 3, 4, 5]);
print reversed_arr = array_reverse(arr)ANSI SQL users
Standard ANSI SQL lacks an explicit function to reverse an array; you generally need to create a custom solution. APL’s array_reverse makes reversing an array straightforward.
SQL example
-- ANSI SQL lacks a built-in array reverse function.APL equivalent
let arr = dynamic([1, 2, 3, 4, 5]);
print reversed_arr = array_reverse(arr)