format_bytes

Usage#

Syntax#

format_bytes(value, precision, units, base)

Parameters#

Name	Type	Required	Description
value	number	Yes	The numeric value representing bytes to format.
precision	number	No	Number of decimal places (default: 0).
units	string	No	Target units. If omitted, units are auto-selected. Base 2 suffixes: `Bytes`, `KiB`, `KB`, `MiB`, `MB`, `GiB`, `GB`, `TiB`, `TB`, `PiB`, `EiB`, `ZiB`, `YiB`. Base 10 suffixes: `kB`, `MB`, `GB`, `TB`, `PB`, `EB`, `ZB`, `YB`.
base	number	No	Either 2 (default, 1024-based) or 10 (1000-based) for unit calculations.

Returns#

Returns a formatted string representing the byte value with appropriate units.

Use case examples#

Log analysisSecurity logs

Format response header sizes as human-readable values for better analysis of payload patterns.

Query

['sample-http-logs']
| extend formatted_size = format_bytes(resp_header_size_bytes, 2)
| summarize avg_size = avg(resp_header_size_bytes), formatted_avg = format_bytes(toint(avg(resp_header_size_bytes)), 2) by status
| sort by avg_size desc
| limit 10

Run in Playground

Output

status	avg_size	formatted_avg
500	8765432	8.36 MB
200	3456789	3.30 MB
404	1234567	1.18 MB
301	456789	446.08 KB

This query formats average response header sizes by HTTP status code, making it easier to identify which status codes are associated with larger data transfers.

Format response header sizes for failed authentication attempts to identify potential data exfiltration or unusual payload patterns.

Query

['sample-http-logs']
| where status == '403' or status == '401'
| extend formatted_size = format_bytes(resp_header_size_bytes, 1)
| summarize failed_attempts = count(), avg_size = format_bytes(toint(avg(resp_header_size_bytes)), 1) by status
| sort by failed_attempts desc

Run in Playground

Output

status	failed_attempts	avg_size
401	1234	850.0 KB
403	987	720.0 KB

This query formats average response header sizes, helping identify unusual payload patterns that might indicate security issues.

parse_bytes: Parses a formatted byte string back to a numeric value. Use this to reverse the formatting operation.
strlen: Returns the length of a string in characters. Use this when you need character count rather than byte formatting.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically need custom eval expressions or lookup tables to format bytes. APL's format_bytes provides this functionality natively.

Splunk example

| eval size_str=if(resp_header_size_bytes<1024, resp_header_size_bytes." B", if(resp_header_size_bytes<1048576, round(resp_header_size_bytes/1024,2)." KB", round(resp_header_size_bytes/1048576,2)." MB"))

APL equivalent

['sample-http-logs']
| extend size_str = format_bytes(resp_header_size_bytes)

ANSI SQL users

In ANSI SQL, formatting bytes requires complex CASE statements. APL's format_bytes simplifies this operation.

SQL example

SELECT CASE
  WHEN resp_header_size_bytes < 1024 THEN CONCAT(resp_header_size_bytes, ' B')
  WHEN resp_header_size_bytes < 1048576 THEN CONCAT(ROUND(resp_header_size_bytes/1024, 2), ' KB')
  ELSE CONCAT(ROUND(resp_header_size_bytes/1048576, 2), ' MB')
END AS size_str FROM logs;