getschema

Usage#

Syntax#

| getschema

Parameters#

The getschema operator doesn’t take any parameters.

Returns#

Field	Type	Description
ColumnName	string	The name of the field in the input.
ColumnOrdinal	number	The index number of the field in the input.
ColumnType	string	The data type of the field.
DataType	string	The APL-internal name for the data type of the field.

Use case example#

Query

['sample-http-logs'] | getschema

Run in Playground

Output

ColumnName	DataType	ColumnOrdinal	ColumnType
_sysTime	datetime	0	datetime
_time	datetime	1	datetime
content_type	string	2	string
geo.city	string	3	string
geo.country	string	4	string
id	string	5	string

project: Use project to select specific fields instead of retrieving the entire schema.
extend: Use extend to add new computed fields to your input after understanding the schema.
summarize: Use summarize for aggregations once you verify field types using getschema.
where: Use where to filter your input based on field values after checking their schema.
order: Use order by to sort your input after verifying schema details.

Other query languages#

Splunk SPL users

In Splunk SPL, you can use the fieldsummary command to get schema-related information about your data. However, getschema in APL is more direct and focused specifically on returning field names and types without additional summary statistics.

Splunk example

| fieldsummary

APL equivalent

['sample-http-logs']
| getschema

ANSI SQL users

In ANSI SQL, retrieving schema information is typically done using INFORMATION_SCHEMA queries. APL’s getschema operator provides a more straightforward way to get schema details without requiring system views.

SQL example

SELECT COLUMN_NAME, DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'sample_http_logs';