Axiom
Overview

len

Use len when you need to:

  • Measure string lengths (for example, long request URIs).
  • Count elements in dynamic arrays (such as tags or multi-value fields).
  • Create conditional expressions based on the length of values.

Usage#

Syntax#

len(value)

Parameters#

Name Type Description
value string or array The input to measure—either a string or an array.

Returns#

  • If value is a string, returns the number of characters.
  • If value is an array, returns the number of elements.
  • Returns null if the input is null.

Use case examples#

Use len to find requests with long URIs, which might indicate poorly designed endpoints or potential abuse.

Query

['sample-http-logs']
| extend uri_length = len(uri)
| where uri_length > 100
| project _time, id, uri, uri_length

Run in Playground

Output

_time id uri uri_length
2025-06-18T12:34:00Z user123 /api/products/search?query=... 132
2025-06-18T12:35:00Z user456 /download/file/very/long/path/... 141

The query filters logs for URIs longer than 100 characters and displays their lengths.

Use len to identify traces with IDs of unexpected length, which might indicate instrumentation issues or data inconsistencies.

Query

['otel-demo-traces']
| extend trace_id_length = len(trace_id)
| summarize count() by trace_id_length

Run in Playground

Output

trace_id_length count
32 4987
16 12

The query summarizes trace IDs by their lengths to find unexpected values.

Use len to analyze request methods and flag unusually short ones (e.g., malformed logs or attack vectors).

Query

['sample-http-logs']
| extend method_length = len(method)
| where method_length < 3
| project _time, id, method, method_length

Run in Playground

Output

_time id method method_length
2025-06-18T13:10:00Z user789 P 1
2025-06-18T13:12:00Z user222 G 1

The query finds suspicious or malformed request methods that are unusually short.

  • array_length: Returns the number of elements in an array. Use this when working specifically with arrays.
  • array_slice: Returns a subarray like array_extract, but supports negative indexing.
  • array_concat: Joins arrays end-to-end. Use before or after slicing arrays with array_extract.

Other query languages#

Splunk SPL users

In Splunk SPL, you often use the len function within eval or where expressions to determine string length or array size. In APL, len works similarly, but is used as a standalone scalar function.

Splunk example

... | eval uri_length=len(uri)

APL equivalent

['sample-http-logs']
| extend uri_length = len(uri)
ANSI SQL users

In ANSI SQL, you use LENGTH() for strings and CARDINALITY() for arrays. In APL, len handles both cases—string and array—depending on the input type.

SQL example

SELECT LENGTH(uri) AS uri_length FROM http_logs;

APL equivalent

['sample-http-logs']
| extend uri_length = len(uri)

Updated

Was this page helpful?