set_intersect
This page explains how to use the set_intersect function in APL.
Use the
Run in Playground
Output
set_intersect function in APL to find common elements between two dynamic arrays. This function returns a new array that contains only the elements that appear in both input arrays, preserving the order from the first array and eliminating duplicates.
You can use set_intersect when you need to compare sets of values—for example, to find users who accessed two different URLs, or to identify traces that passed through multiple services. This function is especially useful for working with dynamic fields generated during aggregations or transformations.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
Splunk SPL does not have a direct equivalent to
set_intersect, but you can achieve similar functionality using mvfilter with conditions based on a lookup or manually defined set. APL simplifies this process by offering a built-in array intersection function.ANSI SQL users
ANSI SQL users
ANSI SQL does not natively support array data types or set operations over arrays. To perform an intersection, you usually need to normalize the arrays using
UNNEST or JOIN, which can be verbose. In APL, set_intersect performs this in a single step.Usage
Syntax
Parameters
| Name | Type | Description |
|---|---|---|
Array1 | dynamic | The first array to compare. |
Array2 | dynamic | The second array to compare. |
Returns
A dynamic array containing elements that exist in bothArray1 and Array2, in the order they appear in Array1, with duplicates removed.
Example
Useset_intersect to return the intersection of two arrays.
Query
| _time | together |
|---|---|
| May 22, 11:42:52 | [2, 3] |
List of related functions
- set_difference: Returns elements in the first array that are not in the second. Use it to find exclusions.
- set_has_element: Tests whether a set contains a specific value. Prefer it when you only need a Boolean result.
- set_union: Returns the union of two or more sets. Use it when you need any element that appears in at least one set instead of every set.