array_iff
function in Axiom Processing Language (APL) allows you to create arrays based on a condition. It returns an array with elements from two specified arrays, choosing each element from the first array when a condition is met and from the second array otherwise. This function is useful for scenarios where you need to evaluate a series of conditions across multiple datasets, especially in log analysis, trace data, and other applications requiring conditional element selection within arrays.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
In Splunk SPL, array manipulation based on conditions typically requires using conditional functions or eval expressions. APL’s
array_iff
function lets you directly select elements from one array or another based on a condition, offering more streamlined array manipulation.ANSI SQL users
ANSI SQL users
In ANSI SQL, conditionally selecting elements from arrays often requires complex
CASE
statements or functions. With APL’s array_iff
function, you can directly compare arrays and conditionally populate them, simplifying array-based operations.Usage
Syntax
Parameters
condition_array
: An array of boolean values, where each element determines whether to choose the corresponding element fromarray1
orarray2
.array1
: The array to select elements from when the correspondingcondition_array
element istrue
.array2
: The array to select elements from when the correspondingcondition_array
element isfalse
.
Returns
An array where each element is selected fromarray1
if the corresponding condition_array
element is true
, and from array2
otherwise.
Use case examples
The Run in PlaygroundOutput
This example filters the
array_iff
function can help filter log data conditionally, such as choosing specific durations based on HTTP status codes.Queryok_request_duration |
---|
[0.3150485097707766, 0, 0.21691408087847264, 0, 0.2757618582190533] |
req_duration_ms
field to include only durations for the most recent 1,000 requests with status 200
, replacing others with 0
.List of related functions
- array_slice: Extracts a subset of elements from an array.
- array_concat: Combines multiple arrays.
- array_rotate_right: Rotates array elements to the right by a specified number of positions.