cursor_current

You use cursor_current when implementing incremental data processing, change data capture (CDC) patterns, or any scenario where you need to track the last processed position in your data. This is particularly useful for building efficient data synchronization pipelines, continuous monitoring systems, and incremental analytics workflows.

Usage#

Syntax#

cursor_current()

Parameters#

This function takes no parameters.

Returns#

A string representing a cursor that marks the current position in the query execution. This cursor can be stored and used in subsequent queries to resume processing from the same point.

Use case examples#

Log analysisOpenTelemetry traces

Use cursor_current to track the last processed position when implementing incremental log processing pipelines.

Query

['sample-http-logs']
| extend processing_cursor = cursor_current()
| where status != '200'
| summarize error_count = count(), last_cursor = make_list(processing_cursor)[0] by bin(_time, 5m)
| take 5

Run in Playground

Output

error_count	last_cursor
343,769	0ddnv2035n4lc-082f23975a003f6b-00006d10

This query captures cursor positions alongside error counts, allowing you to resume processing from the last successful position in case of failures or for incremental updates.

Use cursor_current to implement incremental trace processing for building derived metrics or alerts based on span data.

Query

['otel-demo-traces']
| extend trace_cursor = cursor_current()
| where kind == 'server'
| summarize span_count = count(), latest_cursor = make_list(trace_cursor)[0] by ['service.name'], bin(_time, 5m)
| take 5

Run in Playground

Output

['service.name']	span_count	latest_cursor
frontend	234	cur_xyz456abc789
cart	187	cur_mno123pqr456

This query tracks the processing position for each service, enabling resumable trace analysis and incremental metric computation.

ingestion_time: Use ingestion_time to get the time when data was ingested. Use cursor_current for resumable query execution tracking.
now: Use now to get the current query execution time. Use cursor_current for position tracking in data streams.
bin: Use bin to group data into time buckets. Use cursor_current alongside bin for checkpointed time-series processing.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically use time-based bookmarks or the _indextime field to track processing positions. APL's cursor_current provides a more robust cursor mechanism that works across query executions and handles distributed data more reliably.

Splunk example

| stats max(_indextime) as last_processed

APL equivalent

['sample-http-logs']
| extend cursor = cursor_current()
| summarize max(_time), last_cursor = make_list(cursor)[0]

ANSI SQL users

In ANSI SQL, you typically use MAX(timestamp) or row IDs to track the last processed record. APL's cursor_current provides a system-level cursor that captures the exact query execution position, which is more reliable for distributed systems.

SQL example

SELECT MAX(timestamp) as last_processed_time
FROM logs