pack_array
Usage#
Syntax#
pack_array(value1, value2, ..., valueN)Parameters#
| Parameter | Description |
|---|---|
value1 |
The first value to include in the array. |
value2 |
The second value to include in the array. |
... |
Additional values to include in the array. |
valueN |
The last value to include in the array. |
The wildcard * in pack_array(*) is useful to pack all values from the current row into an array, but it increases query complexity and decreases stability and performance.
pack_array(*) packs only the values, not the field names. For key-value pairs, use bag_pack(*) instead.
Returns#
An array containing the specified values in the order they're provided.
Use case example#
Use pack_array to consolidate span data into an array for a trace summary.
Query
['otel-demo-traces']
| extend span_summary = pack_array(['service.name'], kind, duration)Output
| service.name | kind | duration | span_summary |
|---|---|---|---|
| frontend | server | 123ms |
["frontend", "server", "123ms"] |
This query creates a concise representation of span details.
List of related functions#
- array_slice: Extracts a subset of elements from an array.
- array_concat: Combines multiple arrays.
- array_length: Returns the number of elements in an array.
Other query languages#
Splunk SPL users
In Splunk SPL, you typically use functions like mvappend to create multi-value fields. In APL, the pack_array function serves a similar purpose by combining values into an array.
Splunk example
| eval array_field = mvappend(value1, value2, value3)APL equivalent
| extend array_field = pack_array(value1, value2, value3)ANSI SQL users
In ANSI SQL, arrays are often constructed using functions like ARRAY. The pack_array function in APL performs a similar operation, creating an array from specified values.
SQL example
SELECT ARRAY[value1, value2, value3] AS array_field;APL equivalent
| extend array_field = pack_array(value1, value2, value3)