array_shift_right

When to use the function#

To manage and rotate data within arrays.
To implement cyclic operations or transformations.
To manipulate array data structures in log analysis or telemetry contexts.

Usage#

Syntax#

array_shift_right(array: array) : array

Parameters#

Parameter	Type	Description
`array`	array	The input array whose elements are shifted

Returns#

An array with its elements shifted one position to the right. The last element of the input array wraps around to the first position.

Use case example#

Reorganize span events in telemetry data for visualization or debugging.

Query

['otel-demo-traces']
| take 50
| extend shifted_events = array_shift_right(events, 1)

Run in Playground

Output

events

[
  {
    "name": "Enqueued",
    "timestamp": 1734001215487927300,
    "attributes": null
  },
  {
    "attributes": null,
    "name": "Sent",
    "timestamp": 1734001215487937000
  },
  {
    "timestamp": 1734001215488191000,
    "attributes": null,
    "name": "ResponseReceived"
  }
]

shifted_events

[
  null,
  {
    "timestamp": 1734001215487927300,
    "attributes": null,
    "name": "Enqueued"
  },
  {
    "attributes": null,
    "name": "Sent",
    "timestamp": 1734001215487937000
  }
]

The query rotates span events for better trace debugging.

array_rotate_right: Rotates array elements to the right by a specified number of positions.
array_rotate_left: Rotates elements of an array to the left.
array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.

Other query languages#

Splunk SPL users

In Splunk SPL, similar functionality might be achieved using custom code to rotate array elements, as there is no direct equivalent to array_shift_right. APL provides this functionality natively, making it easier to work with arrays directly.

Splunk example

| eval shifted_array=mvappend(mvindex(array,-1),mvindex(array,0,len(array)-1))

APL equivalent

['dataset.name']
| extend shifted_array = array_shift_right(array)

ANSI SQL users

ANSI SQL doesn’t have a built-in function for shifting arrays. In SQL, achieving this would involve user-defined functions or complex subqueries. In APL, array_shift_right simplifies this operation significantly.

SQL example

WITH shifted AS (
  SELECT
    array_column[ARRAY_LENGTH(array_column)] AS first_element,
    array_column[1:ARRAY_LENGTH(array_column)-1] AS rest_of_elements
  FROM table
)
SELECT ARRAY_APPEND(first_element, rest_of_elements) AS shifted_array
FROM shifted