parse_bytes

Usage#

Syntax#

parse_bytes(bytes_string, base)

Parameters#

Name	Type	Required	Description
bytes_string	string	Yes	A string representing a data size with units (for example, `1 KB`, `500 MB`, `2 GB`).
base	int	No	Either 2 (default, 1024-based) or 10 (1000-based) for unit calculations.

Returns#

Returns the numeric value in bytes, or 0 if the string can't be parsed.

Use case examples#

Log analysisOpenTelemetry traces

Parse human-readable size strings to analyze and aggregate data transfer volumes.

Query

['sample-http-logs']
| extend size_bytes = parse_bytes('512 KB')
| where req_duration_ms > 3
| summarize total_bytes = sum(size_bytes), request_count = count() by status
| sort by total_bytes desc
| limit 10

Run in Playground

Output

status	total_bytes	request_count
200	4587520	8765
500	1048576	2341
404	524288	1234

This query parses size strings to calculate total data transfer by HTTP status code, enabling volume-based analysis of API usage.

Convert size strings from span attributes to numeric bytes for threshold-based analysis.

Query

['otel-demo-traces']
| extend payload_size = parse_bytes('256 KB', 2)
| where duration > 100ms
| summarize avg_size = avg(payload_size), span_count = count() by ['service.name']
| sort by avg_size desc
| limit 10

Run in Playground

Output

service.name	avg_size	span_count
checkout	262144	3421
frontend	262144	4532
cart	262144	2987

This query converts size strings to bytes for numeric analysis of payload sizes across different services.

format_bytes: Formats numeric bytes as human-readable strings. Use this to reverse the parsing operation.
strlen: Returns the length of a string. Use this when you need string length rather than byte parsing.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically need custom eval expressions to parse byte strings. APL's parse_bytes provides this functionality natively.

Splunk example

| eval bytes=case(
    match(size_str, "KB"), tonumber(replace(size_str, " KB", "")) * 1024,
    match(size_str, "MB"), tonumber(replace(size_str, " MB", "")) * 1048576,
    true(), 0)

APL equivalent

['sample-http-logs']
| extend bytes = parse_bytes(size_str)

ANSI SQL users

In ANSI SQL, parsing byte strings requires complex CASE statements. APL's parse_bytes simplifies this operation.

SQL example

SELECT CASE
  WHEN size_str LIKE '%KB%' THEN CAST(REPLACE(size_str, ' KB', '') AS FLOAT) * 1024
  WHEN size_str LIKE '%MB%' THEN CAST(REPLACE(size_str, ' MB', '') AS FLOAT) * 1048576
  ELSE 0
END AS bytes FROM logs;