array_sort_desc

You can use array_sort_desc in scenarios where ordering matters within grouped aggregations, such as collecting response times per user or span durations per trace, and then sorting them to identify the highest or most impactful values.

Usage#

Syntax#

array_sort_desc(array)

Parameters#

Name	Type	Required	Description
array	array	✓	The input array whose elements are sorted descending.

Returns#

If the input is a valid array, the function returns a new array with its elements sorted in descending order. If the array is empty or contains incompatible types, it returns an empty array.

Example#

Query

['sample-http-logs']
| project sort = array_sort_desc(dynamic(['x', 'a', 'm', 'o', 'i']))

Run in Playground

Output

[
  [
    "x",
    "o",
    "m",
    "i",
    "a"
  ]
]

array_index_of: Returns the index of a value in an array. Useful after sorting to locate specific elements.
array_length: Returns the number of elements in an array. Useful for measuring the size of arrays before or after sorting.
array_slice: Extracts a range of elements from an array. Use it after sorting to get the top N or bottom N values.
array_sort_asc: Sorts an array in ascending order. Use this when you want to prioritize smaller values first.

Other query languages#

Splunk SPL users

Splunk doesn’t have a direct equivalent to array_sort_desc, but similar outcomes can be achieved using mvsort with a custom sort order (and sometimes reverse). In APL, array_sort_desc explicitly performs a descending sort on array elements, making it more straightforward.

Splunk example

... | stats list(duration) as durations by id
... | eval durations=reverse(mvsort(durations))

APL equivalent

['otel-demo-traces']
| summarize durations=make_list(duration) by trace_id
| extend durations=array_sort_desc(durations)

ANSI SQL users

ANSI SQL does not support arrays or array functions natively. You typically use window functions or subqueries to order values. In APL, you can work with arrays directly and apply array_sort_desc to sort them.

SQL example

SELECT trace_id, ARRAY_AGG(duration ORDER BY duration DESC) AS durations
FROM traces
GROUP BY trace_id;