array_rotate_left

Usage#

Syntax#

array_rotate_left(array, positions)

Parameters#

array: The array to be rotated. Use a dynamic data type.
positions: An integer specifying the number of positions to rotate the array to the left.

Returns#

A new array where the elements have been rotated to the left by the specified number of positions.

Use case example#

Analyze traces by rotating the field order for visualization or pattern matching.

Query

['otel-demo-traces']
| extend rotated_sequence = array_rotate_left(events, 1)

Run in Playground

Output

events

[
  {
    "name": "Enqueued",
    "timestamp": 1733997117722909000
  },
  {
    "timestamp": 1733997117722911700,
    "name": "Sent"
  },
  {
    "name": "ResponseReceived",
    "timestamp": 1733997117723591400
  }
]

rotated_sequence

[
  {
    "timestamp": 1733997117722911700,
    "name": "Sent"
  },
  {
    "name": "ResponseReceived",
    "timestamp": 1733997117723591400
  },
  {
    "timestamp": 1733997117722909000,
    "name": "Enqueued"
  }
]

This example rotates trace-related fields, which can help to identify variations in trace data when visualized differently.

array_slice: Extracts a subset of elements from an array.
array_rotate_right: Rotates array elements to the right by a specified number of positions.
array_reverse: Reverses the order of array elements.

Other query languages#

Splunk SPL users

In APL, array_rotate_left allows for direct rotation within the array. Splunk SPL doesn’t have a direct equivalent, so you may need to combine multiple SPL functions to achieve a similar rotation effect.

Splunk example

| eval rotated_array = mvindex(array, 1) . "," . mvindex(array, 0)

APL equivalent

print rotated_array = array_rotate_left(dynamic([1,2,3,4]), 1)

ANSI SQL users

ANSI SQL lacks a direct equivalent for array rotation within arrays. A similar transformation can be achieved using array functions if available or by restructuring the array through custom logic.

SQL example

SELECT array_column[2], array_column[3], array_column[0], array_column[1] FROM table