strcat_array

Usage#

Syntax#

strcat_array(array, delimiter)

Parameters#

Parameter	Type	Description
`array`	dynamic	The array of values to concatenate.
`delimiter`	string	The string used to separate each element in the concatenated result. Optional. Defaults to an empty string if not specified.

Returns#

A single concatenated string with the array’s elements separated by the specified delimiter.

Use case example#

You can use strcat_array to combine HTTP methods and URLs for a quick summary of unique request paths.

Query

['sample-http-logs']
| take 50
| extend combined_requests = strcat_delim(' ', method, uri)
| summarize requests_list = make_list(combined_requests)
| extend paths = strcat_array(requests_list, ', ')

Run in Playground

Output

paths
GET /index, POST /submit, GET /about

This query summarizes unique HTTP method and URL combinations into a single, readable string.

array_length: Returns the number of elements in an array.
array_index_of: Finds the index of an element in an array.
array_concat: Combines multiple arrays.

Other query languages#

Splunk SPL users

In Splunk SPL, concatenation typically involves transforming fields into a string using the eval command with the + operator or mvjoin() for arrays. In APL, strcat_array simplifies array concatenation by natively supporting array input with a delimiter.

Splunk example

| eval concatenated=mvjoin(array_field, ", ")

APL equivalent

dataset
| extend concatenated = strcat_array(array_field, ', ')

ANSI SQL users

In ANSI SQL, concatenation involves functions like STRING_AGG() or manual string building using CONCAT(). APL’s strcat_array is similar to STRING_AGG(), but focuses on array input directly with a customizable delimiter.

SQL example

SELECT STRING_AGG(column_name, ', ') AS concatenated FROM table;