Axiom
Overview

gettype

Usage#

Syntax#

gettype(expression)

Parameters#

Name Type Required Description
expression any Yes The expression whose type you want to determine.

Returns#

Returns a string representing the runtime type: string, int, long, real, bool, datetime, timespan, dynamic, array, dictionary, or null.

Use case examples#

Identify the data types of fields to ensure proper query operations and data validation.

Query

['sample-http-logs']
| extend status_type = gettype(status),
         duration_type = gettype(req_duration_ms),
         time_type = gettype(_time)
| project status, status_type, req_duration_ms, duration_type, _time, time_type
| limit 10

Run in Playground

Output

status status_type req_duration_ms duration_type _time time_type
200 string 145 long 2024-11-06T10:00:00Z datetime
404 string 89 long 2024-11-06T10:01:00Z datetime
500 string 234 long 2024-11-06T10:02:00Z datetime

This query identifies the data types of key fields in HTTP logs, helping ensure that data is in the expected format for analysis and troubleshooting type-related query issues.

Validate trace field types to ensure proper data ingestion and processing.

Query

['otel-demo-traces']
| extend service_type = gettype(['service.name']),
         duration_type = gettype(duration),
         kind_type = gettype(kind)
| summarize type_counts = count() by service_type, duration_type, kind_type

Run in Playground

Output

service_type duration_type kind_type type_counts
string timespan string 8765

This query validates the types of trace fields, helping identify data quality issues where fields might have unexpected types due to ingestion problems.

Detect type inconsistencies in security logs that might indicate data manipulation or logging errors.

Query

['sample-http-logs']
| extend id_type = gettype(id),
         status_type = gettype(status),
         uri_type = gettype(uri)
| summarize failed_attempts = count() by id_type, status_type, uri_type
| sort by failed_attempts desc

Run in Playground

Output

id_type status_type uri_type failed_attempts
string string string 2341

This query validates field types in failed authentication logs, helping detect anomalies where expected string fields might have different types due to injection attempts or data corruption.

  • isnull: Checks if a value is null. Use this to specifically test for null values rather than getting the type.
  • isnotnull: Checks if a value isn't null. Use this in filters when you need to exclude null values.
  • parse_json: Parses JSON strings into dynamic types. Use this before gettype when working with JSON data.

Other query languages#

Splunk SPL users

In Splunk SPL, you use typeof to check types. APL's gettype provides similar functionality with consistent type names.

Splunk example

| eval field_type=typeof(field_name)

APL equivalent

['sample-http-logs']
| extend field_type = gettype(field_name)
ANSI SQL users

In ANSI SQL, type checking varies by database. APL's gettype provides a standardized approach to runtime type detection.

SQL example

SELECT TYPEOF(field_name) AS field_type FROM logs;

APL equivalent

['sample-http-logs']
| extend field_type = gettype(field_name)

Updated

Was this page helpful?