array_sort_asc

You can apply array_sort_asc to arrays of numbers, strings, or dynamic objects, making it useful across many telemetry, logging, and security data scenarios.

Usage#

Syntax#

array_sort_asc(array)

Parameters#

Name	Type	Required	Description
array	dynamic	✓	An array of values to sort. Can be numbers, strings, or other primitives.

Returns#

A new array that contains the same elements as the input array, sorted in ascending order. If the input isn't an array, the function returns an empty array.

Example#

Query

['sample-http-logs']
| project sort = array_sort_asc(dynamic(['x', 'a', 'm', 'o', 'i']))

Run in Playground

Output

[
  [
    "a",
    "i",
    "m",
    "o",
    "x"
  ]
]

array_index_of: Returns the position of an element in an array. Use after sorting to find where values fall.
array_length: Returns the number of elements in an array. Use to understand array size before or after sorting.
array_slice: Returns a subrange of the array. Useful after sorting to get top-N or bottom-N elements.
array_sort_desc: Sorts array elements in descending order. Use when you need reverse ordering.

Other query languages#

Splunk SPL users

In Splunk SPL, arrays are typically handled through mvsort, which sorts multivalue fields in ascending order. In APL, array_sort_asc provides similar functionality but works on dynamic arrays and returns a new sorted array.

Splunk example

| eval sorted_values = mvsort(multivalue_field)

APL equivalent

datatable(arr: dynamic)
[
  dynamic([4, 2, 5])
]
| extend sorted_arr = array_sort_asc(arr)

ANSI SQL users

ANSI SQL does not directly support array data types or array sorting. You typically normalize arrays with UNNEST and sort the results using ORDER BY. In APL, you can sort arrays inline using array_sort_asc, which is more concise and expressive.

SQL example

SELECT val
FROM UNNEST([4, 2, 5]) AS val
ORDER BY val ASC