parse_pair

Use parse_pair when you have strings like host:server1 or env=production and need to access the key or value individually for filtering, grouping, or analysis.

Usage#

Syntax#

parse_pair(pair_string, [separator])

Parameters#

Name	Type	Required	Description
`pair_string`	`string`	Required	The string containing the key-value pair to parse.
`separator`	`string`	Optional	The separator between the key and value. Defaults to `:`.

Returns#

A dynamic object with the following properties:

key: The extracted key portion of the pair.
value: The extracted value portion of the pair.
separator: The separator used in the pair.

If the separator isn't found in the input string, the function returns a pair with the entire input as the value and an empty key.

Example#

Extract and analyze tag components from HTTP request metadata.

Query

['sample-http-logs']
| extend tag_string = strcat('method:', method)
| extend parsed = parse_pair(tag_string)
| project _time, uri, tag_string, parsed

Run in Playground

Output

_time	uri	tag_string	parsed
2025-01-29 08:15:30	/api/user	method:GET	`{"key": "method", "separator": ":", "value": "GET"}`
2025-01-29 08:16:45	/api/data	method:POST	`{"key": "method", "separator": ":", "value": "POST"}`
2025-01-29 08:17:20	/api/login	method:POST	`{"key": "method", "separator": ":", "value": "POST"}`

This query constructs tag strings and then parses them to extract individual key and value components for analysis.

pair: Creates a pair string from key and value components. Use parse_pair to decompose existing pairs.
find_pair: Searches an array of pairs for a matching pattern. Use parse_pair when you need to extract components from a single pair string.
split: Splits a string by a delimiter into an array. Use parse_pair when you specifically need key-value extraction with structured output.
extract: Extracts substrings using regex. Use parse_pair for simpler key-value parsing without regex.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically use rex or split commands to extract key-value components from strings. APL's parse_pair provides a dedicated function for this common operation.

Splunk example

| rex field=tag "(?<key>[^:]+):(?<value>.*)"

APL equivalent

['sample-http-logs']
| extend parsed = parse_pair('host:server1')
| extend key = parsed.key, value = parsed.value

ANSI SQL users

In ANSI SQL, you use SUBSTRING with POSITION or SPLIT_PART to extract key-value components. APL's parse_pair simplifies this with a dedicated function.

SQL example

SELECT
  SPLIT_PART(tag, ':', 1) AS key,
  SPLIT_PART(tag, ':', 2) AS value
FROM logs