Docs
DocumentationQuery ReferenceAPI Reference
Open Console→→
DocumentationQuery ReferenceAPI Reference

Introduction

Query reference overview

APL

IntroductionSample queriesAll features
Functions
Scalar functions
Array functions
Overview
array_concat
array_extract
array_iff
array_index_of
array_length
array_reverse
array_rotate_left
array_rotate_right
array_select_dict
array_shift_left
array_shift_right
array_slice
array_sort_asc
array_sort_desc
array_split
array_sum
bag_has_key
bag_keys
bag_pack
bag_zip
isarray
len
pack_array
pack_dictionary
strcat_array
Conditional functions
Overview
case
iff
Conversion functions
Overview
dynamic_to_json
ensure_field
isbool
toarray
tobool
todatetime
todouble, toreal
todynamic
tohex
toint, tolong
tostring
totimespan
Datetime functions
Overview
ago
datetime_add
datetime_diff
datetime_part
dayofmonth
dayofweek
dayofyear
endofday
endofmonth
endofweek
endofyear
getmonth
getyear
hourofday
monthofyear
now
startofday
startofmonth
startofweek
startofyear
unixtime_microseconds_todatetime
unixtime_milliseconds_todatetime
unixtime_nanoseconds_todatetime
unixtime_seconds_todatetime
week_of_year
GenAI functions
Overview
genai_concat_contents
genai_conversation_turns
genai_cost
genai_estimate_tokens
genai_extract_assistant_response
genai_extract_function_results
genai_extract_system_prompt
genai_extract_tool_calls
genai_extract_user_prompt
genai_get_content_by_index
genai_get_content_by_role
genai_get_pricing
genai_get_role
genai_has_tool_calls
genai_input_cost
genai_is_truncated
genai_message_roles
genai_output_cost
Hash functions
Overview
hash
hash_md5
hash_sha1
hash_sha256
hash_sha512
IP functions
Overview
format_ipv4
format_ipv4_mask
geo_info_from_ip_address
has_any_ipv4
has_any_ipv4_prefix
has_ipv4
has_ipv4_prefix
ipv4_compare
ipv4_is_in_range
ipv4_is_in_any_range
ipv4_is_match
ipv4_is_private
ipv4_netmask_suffix
ipv6_compare
ipv6_is_in_any_range
ipv6_is_in_range
ipv6_is_match
parse_ipv4
parse_ipv4_mask
Mathematical functions
Overview
abs
acos
asin
atan
atan2
cos
cot
degrees
exp
exp2
exp10
gamma
isfinite
isinf
isint
isnan
log
log2
log10
loggamma
max_of
min_of
not
pi
pow
radians
rand
range
round
set_difference
set_has_element
set_intersect
set_union
sign
sin
sqrt
tan
Metadata functions
Overview
column_ifexists
cursor_current
ingestion_time
Pair functions
Overview
find_pair
pair
parse_pair
Rounding functions
Overview
bin
bin_auto
ceiling
floor
String functions
Overview
base64_decode_toarray
base64_decode_tostring
base64_encode_fromarray
base64_encode_tostring
coalesce
countof
countof_regex
extract
extract_all
format_bytes
format_url
gettype
indexof
indexof_regex
isascii
isempty
isnotempty
isnotnull
isnull
parse_bytes
parse_csv
parse_json
parse_path
parse_url
parse_urlquery
quote
regex_quote
replace
replace_regex
replace_string
reverse
split
strcat
strcat_delim
strcmp
string_size
strlen
strrep
strip_ansi_escapes
substring
tolower
totitle
toupper
translate
trim
trim_end
trim_end_regex
trim_regex
trim_space
trim_start
trim_start_regex
unicode_codepoints_from_string
unicode_codepoints_to_string
url_decode
url_encode
SQL functions
Overview
parse_sql
format_sql
Time series functions
Overview
series_abs
series_acos
series_add
series_asin
series_atan
series_ceiling
series_cos
series_cosine_similarity
series_divide
series_dot_product
series_equals
series_exp
series_fft
series_fill_backward
series_fill_const
series_fill_forward
series_fill_linear
series_fir
series_floor
series_greater
series_greater_equals
series_ifft
series_iir
series_less
series_less_equals
series_log
series_magnitude
series_max
series_min
series_multiply
series_not_equals
series_pearson_correlation
series_pow
series_sign
series_sin
series_stats
series_stats_dynamic
series_subtract
series_sum
series_tan
Type functions
Overview
isimei
ismap
isreal
iscc
isstring
isutf8
Aggregation functions
Overview
arg_min
arg_max
avg
avgif
count
countif
dcount
dcountif
histogram
histogramif
make_list
make_list_if
make_set
make_set_if
max
maxif
min
minif
percentile
percentileif
percentiles_array
percentiles_arrayif
phrases
rate
spotlight
stdev
stdevif
sum
sumif
topk
topkif
variance
varianceif
Operators
Tabular operators
Overview
count
distinct
extend
extend-valid
externaldata
getschema
join
limit
lookup
make-series
mv-expand
order
parse
parse-kv
parse-where
project
project-away
project-keep
project-rename
project-reorder
redact
sample
search
sort
summarize
take
top
union
where
Scalar operators
Set membership operators
Overview
in
!in
in~
!in~
Logical
Numerical
String
Reference
Entity names
Map fields
Null values
Scalar data types
Set statement
Special field attributes
Migrate
Splunk SPL
SQL
Sumo Logic

MPL

Language featuresSample queriesMigrate
APL/Reference

Scalar data types

This page explains the data types in APL.

Axiom Processing Language supplies a set of system data types that define all the types of data that can be used with APL.

The following table lists the data types supported by APL, alongside additional aliases you can use to refer to them.

TypeAdditional namesgettype()
bool()booleanint8
datetime()datedatetime
dynamic()array or dictionary or any other of the other values
int()int has an alias longint
long()long
real()doublereal
string()string
timespan()timetimespan

The bool data type

The bool (boolean) data type can have one of two states: true or false (internally encoded as 1 and 0, respectively), as well as the null value.

bool literals

The bool data type has the following literals:

  • true and bool(true): Representing trueness
  • false and bool(false): Representing falsehood
  • null and bool(null): Representing the null value

bool operators

The bool data type supports the following operators: equality (==), inequality (!=), logical-and (and), and logical-or (or).

The datetime data type

The datetime (date) data type represents an instant in time, typically expressed as a date and time of day. Values range from 00:00:00 (midnight), January 1, 0001 Anno Domini (Common Era) through 11:59:59 PM, December 31, 9999 AD (CE) in the Gregorian calendar.

datetime literals

Literals of type datetime have the syntax datetime (value), where a number of formats are supported for value, as indicated by the following table:

ExampleValue
datetime(2019-11-30 23:59:59.9) datetime(2015-12-31)Times are always in UTC. Omitting the date gives a time today.
datetime(null)Check out null values
now()The current time.
now(-timespan)now()-timespan
ago(timespan)now()-timespan

now() and ago() indicate a datetime value compared with the moment in time when APL started to execute the query.

Supported formats

Axiom supports the ISO 8601 format which is the standard format for representing dates and times in the Gregorian calendar.

FormatExample
%Y-%m-%dT%H:%M:%s%z2016-06-26T08:20:03.123456Z
%Y-%m-%dT%H:%M:%s2016-06-26T08:20:03.123456
%Y-%m-%dT%H:%M2016-06-26T08:20
%Y-%m-%d %H:%M:%s%z2016-10-06 15:55:55.123456Z
%Y-%m-%d %H:%M:%s2016-10-06 15:55:55
%Y-%m-%d %H:%M2016-10-06 15:55
%Y-%m-%d2014-11-08

The dynamic data type

The dynamic scalar data type is special in that it can take on any value of other scalar data types from the list below, as well as arrays and property bags. Specifically, a dynamic value can be:

  • null
  • A value of any of the primitive scalar data types: bool, datetime, int, long, real, string, and timespan.
  • An array of dynamic values, holding zero or more values with zero-based indexing.
  • A property bag, holding zero or more key-value pairs.

Dynamic literals

A literal of type dynamic looks like this:

dynamic (Value)

Value can be:

  • null, in which case the literal represents the null dynamic value: dynamic(null).
  • Another scalar data type literal, in which case the literal represents the dynamic literal of the "inner" type. For example, dynamic(6) is a dynamic value holding the value 6 of the long scalar data type.
  • An array of dynamic or other literals: [ListOfValues]. For example, dynamic([3, 4, "bye"]) is a dynamic array of three elements, two long values and one string value.
  • A property bag: {Name=Value ...}. For example, dynamic(\{"a":1, "b":\{"a":2\}\}) is a property bag with two slots, a, and b, with the second slot being another property bag.

The int data type

The int data type represents a signed, 64-bit wide, integer.

The special form int(null) represents the null value.

int has an alias long

The long data type

The long data type represents a signed, 64-bit wide, integer.

long literals

Literals of the long data type can be specified in the following syntax:

long(Value)

Where Value can take the following forms:

  • One more or digits, in which case the literal value is the decimal representation of these digits. For example, long(11) is the number eleven of type long.
  • A minus (-) sign followed by one or more digits. For example, long(-3) is the number minus three of type long.
  • null, in which case this is the null value of the long data type. Thus, the null value of type long is long(null).

The real data type

The real data type represents a 64-bit wide, double-precision, floating-point number.

The string data type

The string data type represents a sequence of zero or more Unicode characters.

String literals

There are several ways to encode literals of the string data type in a query text:

  • Enclose the string in double-quotes("): "This is a string literal. Single quote characters (') don’t require escaping. Double quote characters (") are escaped by a backslash (\)"
  • Enclose the string in single-quotes ('): Another string literal. Single quote characters (') require escaping by a backslash (\). Double quote characters (") don’t require escaping.

In the two representations above, the backslash (\) character indicates escaping. The backslash is used to escape the enclosing quote characters, tab characters (\t), newline characters (\n), and itself (\\).

Raw string literals

Raw string literals are also supported. In this form, the backslash character (\) stands for itself, and doesn’t denote an escape sequence.

  • Enclosed in double-quotes (""): @"This is a raw string literal"
  • Enclose in single-quotes ('): @'This is a raw string literal'

Raw strings are particularly useful for regexes where you can use @"^[\d]+$" instead of "^[\\d]+$".

The timespan data type

The timespan (time) data type represents a time interval.

timespan literals

Literals of type timespan have the syntax timespan(value), where a number of formats are supported for value, as indicated by the following table:

Valuelength of time
'2d2 days
1.5h1.5 hour
30m30 minutes
10s10 seconds
timespan(15s)15 seconds
0.1s0.1 second
timespan(2d)2 days

Type conversions

APL provides a set of functions to convert values between different scalar data types. These conversion functions allow you to convert a value from one type to another.

Some of the commonly used conversion functions include:

  • tobool(): Converts input to boolean representation.
  • todatetime(): Converts input to datetime scalar.
  • todouble() or toreal(): Converts input to a value of type real.
  • tostring(): Converts input to a string representation.
  • totimespan(): Converts input to timespan scalar.
  • tolong(): Converts input to long (signed 64-bit) number representation.
  • toint(): Converts input to an integer value (signed 64-bit) number representation.

For a complete list of conversion functions and their detailed descriptions and examples, refer to the Conversion functions documentation.

Was this page helpful?
Suggest edits on GitHub
PreviousNull valuesNextSet statement
On this page
The bool data typebool literalsbool operatorsThe datetime data typedatetime literalsSupported formatsThe dynamic data typeDynamic literalsThe int data typeThe long data typelong literalsThe real data typeThe string data typeString literalsRaw string literalsThe timespan data typetimespan literalsType conversions