isarray

Usage#

Syntax#

isarray(value)

Parameters#

Parameter	Description
`value`	The value to check if it’s an array.

Returns#

A boolean value:

true if the specified value is an array.
false otherwise.

Use case example#

Filter for records where the events field contains an array.

Query

['otel-demo-traces']
| take 50
| summarize events_array = make_list(events)
| extend is_array = isarray(events_array)

Run in Playground

Output

is_array
true

array_length: Returns the number of elements in an array.
array_index_of: Finds the index of an element in an array.
array_slice: Extracts a subset of elements from an array.

Other query languages#

Splunk SPL users

In Splunk SPL, similar functionality is achieved by analyzing the data structure manually, as SPL doesn’t have a direct equivalent to isarray. APL simplifies this task by providing the isarray function to directly evaluate whether a value is an array.

Splunk example

| eval is_array=if(isnotnull(mvcount(field)), "true", "false")

APL equivalent

['dataset.name']
| extend is_array=isarray(field)

ANSI SQL users

In ANSI SQL, there is no built-in function for directly checking if a value is an array. You might need to rely on JSON functions or structural parsing. APL provides the isarray function as a more straightforward solution.

SQL example

SELECT CASE
         WHEN JSON_TYPE(field) = 'ARRAY' THEN TRUE
         ELSE FALSE
       END AS is_array
FROM dataset_name;