Skip to main content

​
Introduction

The iff function evaluates a single Boolean predicate and returns one of two values depending on the result. Use it to add binary flag columns, choose between two computed expressions, or conditionally override a value in one step. The iif function is an alias for iff and behaves identically. For three or more branches, use case instead.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
Splunk SPL uses if(condition, value_if_true, value_if_false) inside an eval command. APL’s iff takes the same three arguments in the same order.
... | eval speed = if(req_duration_ms > 1000, "slow", "fast")
SQL Server provides IIF(condition, value_if_true, value_if_false), which maps directly to APL’s iff. In ANSI SQL you can also write CASE WHEN condition THEN value_if_true ELSE value_if_false END, which is equivalent.
SELECT IIF(req_duration_ms > 1000, 'slow', 'fast') AS speed
FROM sample_http_logs

​
Usage

​
Syntax

iff(predicate, ifTrue, ifFalse)

​
Parameters

NameTypeRequiredDescription
predicateboolYesExpression that evaluates to true or false.
ifTruescalarYesValue returned when predicate is true.
ifFalsescalarYesValue returned when predicate is false. Must be the same type as ifTrue.

​
Returns

The value of ifTrue when predicate evaluates to true, or ifFalse otherwise.
To return a null value from iff, use dynamic(null).
iff(condition, dynamic(null), value)

​
Use case examples

Flag requests that take longer than one second to identify slow endpoints.Query
['sample-http-logs']
| extend is_slow = iff(req_duration_ms > 1000, 'slow', 'fast')
| summarize count() by is_slow
Run in PlaygroundOutput
is_slowcount_
fast9630
slow501
The query adds a is_slow column to each request and then counts how many fall into each category.
  • case: Multi-branch conditional that evaluates a list of conditions and returns the first matching result. Use case when you have three or more outcomes.
  • coalesce: Returns the first non-null value from a list of expressions. Use coalesce when you want to fall back from null rather than branch on a condition.