toarray

You typically use toarray when working with semi-structured data, especially after parsing JSON from log fields or external sources. It lets you access and manipulate nested collections using standard array operations.

Usage#

Syntax#

toarray(value)

Parameters#

Name	Type	Description
value	dynamic	A JSON array, property bag, or bag value

Returns#

An array containing the elements of the dynamic input. If the input is already an array, the result is identical. If the input is a property bag, it returns an array of values. If the input isn’t coercible to an array, the result is an empty array.

Example#

You want to convert a string to an array because you want to pass the result to a function that accepts arrays, such as array_concat.

Query

['otel-demo-traces']
| extend service_list = toarray('123')
| extend json_list = parse_json('["frontend", "cartservice", "checkoutservice"]')
| extend combined_list = array_concat(service_list, json_list)
| project _time, combined_list

Run in Playground

Output

_time	combined_list
Jun 24, 09:28:10	`["123", "frontend", "cartservice", "checkoutservice"]`
Jun 24, 09:28:10	`["123", "frontend", "cartservice", "checkoutservice"]`
Jun 24, 09:28:10	`["123", "frontend", "cartservice", "checkoutservice"]`

array_length: Returns the number of elements in an array. Useful before applying array_extract.
array_index_of: Finds the position of an element in an array, which can help set the startIndex for array_extract.
pack_array: Use this to combine scalar values into an array. Use pack_array when you don’t need named keys and want positional data instead.
bag_keys: Returns the list of keys in a dynamic dictionary. Use this to inspect or filter contents created by pack_dictionary.
bag_pack: Expands a dictionary into multiple columns. Use it to revert the packing performed by pack_dictionary.

Other query languages#

Splunk SPL users

In Splunk, multivalue fields are native, and many SPL commands like mvexpand, mvindex, and mvcount operate directly on them. In APL, dynamic fields can also contain multivalue data, but you need to explicitly convert them to arrays using toarray before applying array functions.

Splunk example

... | eval methods=split("GET,POST,PUT", ",") | mvcount(methods)

APL equivalent

print methods = dynamic(["GET", "POST", "PUT"])
| extend method_count = array_length(toarray(methods))

ANSI SQL users

ANSI SQL doesn’t support arrays natively. You typically store lists as JSON and use JSON functions to manipulate them. In APL, you can parse JSON into dynamic values and use toarray to convert those into arrays for further processing.

SQL example

SELECT JSON_ARRAY_LENGTH('["GET","POST","PUT"]')