Docs
Open console →

strlen

This page explains how to use the strlen function in APL.

The strlen function returns the length of a string in characters. Use this function to validate field lengths, filter by size constraints, or analyze text content patterns in your logs.

Usage

Syntax

strlen(source)

Parameters

NameTypeRequiredDescription
sourcestringYesThe string to measure.

Returns

Returns the length of the string in characters (not bytes).

Use case examples

Analyze URI lengths to identify potential long-URL attacks or data exfiltration attempts.

Query

['sample-http-logs']
| extend uri_length = strlen(uri)
| summarize avg_length = avg(uri_length),
            max_length = max(uri_length),
            long_uri_count = countif(uri_length > 200) by method, status
| sort by max_length desc
| limit 10

Run in Playground

Output

methodstatusavg_lengthmax_lengthlong_uri_count
GET20045.3512234
POST40438.738789

This query analyzes URI length patterns to identify unusually long requests that might indicate attacks or data exfiltration attempts.

Monitor trace ID and span ID length consistency to validate instrumentation correctness.

Query

['otel-demo-traces']
| extend trace_id_length = strlen(trace_id)
| extend span_id_length = strlen(span_id)
| summarize id_length_consistent = countif(trace_id_length == span_id_length),
            trace_avg = avg(trace_id_length),
            span_avg = avg(span_id_length) by ['service.name']
| sort by id_length_consistent desc
| limit 10

Run in Playground

Output

service.nameid_length_consistenttrace_avgspan_avg
frontend453232.016.0
checkout342132.016.0

This query validates that trace and span IDs have expected lengths, helping identify instrumentation issues where IDs might be malformed.

Detect potential buffer overflow attacks by identifying unusually long user identifiers or input fields.

Query

['sample-http-logs']
| extend id_length = strlen(id)
| extend uri_length = strlen(uri)
| where id_length > 50 or uri_length > 500
| project _time, id, id_length, uri, uri_length, status, ['geo.country']
| sort by id_length desc, uri_length desc
| limit 10

Run in Playground

Output

_timeidid_lengthuriuri_lengthstatusgeo.country
2024-11-06T10:00:00Zverylong...87/api/...612403Unknown

This query identifies requests with abnormally long identifiers or URIs, which could indicate buffer overflow attempts or other injection attacks.

  • substring: Extracts parts of strings. Use this with strlen to extract specific length substrings.
  • isempty: Checks if a string is empty. Use this to test for zero-length strings more explicitly.
  • countof: Counts substring occurrences. Use this when you need occurrence counts rather than total length.
  • format_bytes: Formats bytes as strings. Use this to format length values for display.

Other query languages