> ## Documentation Index > Fetch the complete documentation index at: https://axiom-mano-sample-app.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # String functions > Learn how to use and combine different string functions in APL ## String functions | **Function Name** | **Description** | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [base64\_encode\_tostring()](#base64-encode-tostring) | Encodes a string as base64 string. | | [base64\_decode\_tostring()](#base64-decode-tostring) | Decodes a base64 string to a UTF-8 string. | | [countof()](#countof) | Counts occurrences of a substring in a string. | | [countof\_regex()](#countof-regex) | Counts occurrences of a substring in a string. Regex matches don’t. | | [coalesce()](#coalesce) | Evaluates a list of expressions and returns the first non-null (or non-empty for string) expression. | | [extract()](#extract) | Get a match for a regular expression from a text string. | | [extract\_all()](#extract-all) | Get all matches for a regular expression from a text string. | | [format\_bytes()](#format-bytes) | Formats a number of bytes as a string including bytes units | | [format\_url()](#format-url) | Formats an input string into a valid URL by adding the necessary protocol if it’s escaping illegal URL characters. | | [indexof()](#indexof) | Function reports the zero-based index of the first occurrence of a specified string within input string. | | [isempty()](#isempty) | Returns true if the argument is an empty string or is null. | | [isnotempty()](#isnotempty) | Returns true if the argument isn’t an empty string or a null. | | [isnotnull()](#isnotnull) | Returns true if the argument is not null. | | [isnull()](#isnull) | Evaluates its sole argument and returns a bool value indicating if the argument evaluates to a null value. | | [parse\_bytes()](#parse-bytes) | Parses a string including byte size units and returns the number of bytes | | [parse\_json()](#parse-json) | Interprets a string as a JSON value) and returns the value as dynamic. | | [parse\_url()](#parse-url) | Parses an absolute URL string and returns a dynamic object contains all parts of the URL. | | [parse\_urlquery()](#parse-urlquery) | Parses a url query string and returns a dynamic object contains the Query parameters. | | [replace()](#replace) | Replace all regex matches with another string. | | [replace\_regex()](#replace-regex) | Replaces all regex matches with another string. | | [replace\_string()](#replace-string) | Replaces all string matches with another string. | | [reverse()](#reverse) | Function makes reverse of input string. | | [split()](#split) | Splits a given string according to a given delimiter and returns a string array with the contained substrings. | | [strcat()](#strcat) | Concatenates between 1 and 64 arguments. | | [strcat\_delim()](#strcat-delim) | Concatenates between 2 and 64 arguments, with delimiter, provided as first argument. | | [strcmp()](#strcmp) | Compares two strings. | | [strlen()](#strlen) | Returns the length, in characters, of the input string. | | [strrep()](#strrep) | Repeats given string provided number of times (default = 1). | | [substring()](#substring) | Extracts a substring from a source string starting from some index to the end of the string. | | [toupper()](#toupper) | Converts a string to upper case. | | [tolower()](#tolower) | Converts a string to lower case. | | [trim()](#trim) | Removes all leading and trailing matches of the specified cutset. | | [trim\_regex()](#trim-regex) | Removes all leading and trailing matches of the specified regular expression. | | [trim\_end()](#trim-end) | Removes trailing match of the specified cutset. | | [trim\_end\_regex()](#trim-end-regex) | Removes trailing match of the specified regular expression. | | [trim\_start()](#trim-start) | Removes leading match of the specified cutset. | | [trim\_start\_regex()](#trim-start-regex) | Removes leading match of the specified regular expression. | | [url\_decode()](#url-decode) | The function converts encoded URL into a regular URL representation. | | [url\_encode()](#url-encode) | The function converts characters of the input URL into a format that can be transmitted over the Internet. | | [gettype()](#gettype) | Returns the runtime type of its single argument. | | [parse\_csv()](#parse-csv) | Splits a given string representing a single record of comma-separated values and returns a string array with these values. | Each argument has a **required** section which is denoted with `required` or `optional` * If it’s denoted by `required` it means the argument must be passed into that function before it'll work. * if it’s denoted by `optional` it means the function can work without passing the argument value. ## base64\_encode\_tostring() Encodes a string as base64 string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ------------------------------------------------------------ | | String | string | Required | Input string or string field to be encoded as base64 string. | ### Returns Returns the string encoded as base64 string. * To decode base64 strings to UTF-8 strings, see [base64\_decode\_tostring()](#base64-decode-tostring) ### Examples ```kusto base64_encode_tostring(string) ``` ```kusto ['sample-http-logs'] | project encoded_base64_string = base64_encode_tostring(content_type) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20encoded_base64_string%20%3D%20base64_encode_tostring\(content_type\)%22%7D) ## base64\_decode\_tostring() Decodes a base64 string to a UTF-8 string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ------------------------------------------------------------------------ | | String | string | Required | Input string or string field to be decoded from base64 to UTF8-8 string. | ### Returns Returns UTF-8 string decoded from base64 string. * To encode strings to base64 string, see [base64\_encode\_tostring()](#base64-encode-tostring) ### Examples ```kusto base64_decode_tostring(string) ``` ```kusto ['sample-http-logs'] | project decoded_base64_string = base64_decode_tostring("VGhpcyBpcyBhbiBlbmNvZGVkIG1lc3NhZ2Uu") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20decoded_base64_string%20%3D%20base64_decode_tostring\(%5C%22VGhpcyBpcyBhbiBlbmNvZGVkIG1lc3NhZ2Uu%5C%22\)%22%7D) ## countof() Counts occurrences of a substring in a string. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | ----------- | ---------- | ---------------------------------------- | ------------------------ | | text source | **string** | Source to count your occurences from | Required | | search | **string** | The plain string to match inside source. | Required | ### Returns The number of times that the search string can be matched. ### Examples ```kusto countof(search, text) ``` ```kusto ['sample-http-logs'] | project count = countof("con", "content_type") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20count%20%3D%20countof\(%5C%22con%5C%22%2C%20%5C%22content_type%5C%22\)%22%7D) ## countof\_regex() Counts occurrences of a substring in a string. regex matches don’t. ### Arguments * text source: A string. * regex search: regular expression to match inside your text source. ### Returns The number of times that the search string can be matched in the dataset. Regex matches do not. ### Examples ```kusto countof_regex(regex, text) ``` ```kusto ['sample-http-logs'] | project count = countof_regex("c.n", "content_type") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20count%20%3D%20countof_regex\(%5C%22c.n%5C%22%2C%20%5C%22content_type%5C%22\)%22%7D) ## coalesce() Evaluates a list of expressions and returns the first non-null (or non-empty for string) expression. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | --------- | ---------- | ---------------------------------------- | ------------------------ | | arguments | **scalar** | The expression or field to be evaluated. | Required | ### Returns The value of the first argument whose value isn’t null (or not-empty for string expressions). ### Examples ```kusto ['sample-http-logs'] | project coalesced = coalesce(content_type, ['geo.city'], method) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20coalesced%20%3D%20coalesce\(content_type%2C%20%5B%27geo.city%27%5D%2C%20method\)%22%7D) ```kusto ['http-logs'] | project req_duration_ms, server_datacenter, predicate = coalesce(content_type, method, status) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20req_duration_ms%2C%20server_datacenter%2C%20predicate%20%3D%20coalesce\(content_type%2C%20method%2C%20status\)%22%7D) ## extract() Retrieve the first substring matching a regular expression from a source string. ### Arguments | **name** | **type** | **description** | | ------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | regex | **expression** | A regular expression. | | captureGroup | **int** | A positive `int` constant indicating the capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, 2 or more for subsequent parentheses. | | source | **string** | A string to search | ### Returns If regex finds a match in source: the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral. If there’s no match, or the type conversion fails: `-1` or `string error` ### Examples ```kusto extract(regex, captureGroup, source) ``` ```kusto ['sample-http-logs'] | project extract_sub = extract("^.{2,2}(.{4,4})", 1, content_type) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20extract_sub%20%3D%20%20extract\(%5C%22%5E.%7B2%2C2%7D\(.%7B4%2C4%7D\)%5C%22%2C%201%2C%20content_type\)%22%7D) ```kusto extract("x=([0-9.]+)", 1, "axiom x=65.6|po") == "65.6" ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20extract_sub%20%3D%20%20extract\(%5C%22x%3D\(%5B0-9.%5D%2B\)%5C%22%2C%201%2C%20%5C%22axiom%20x%3D65.6%7Cpo%5C%22\)%20%3D%3D%20%5C%2265.6%5C%22%22%7D) ## extract\_all() Retrieve all substrings matching a regular expression from a source string. Optionally, retrieve only a subset of the matching groups. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | ------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | regex | **expression** | A regular expression containing between one and 16 capture groups. Examples of a valid regex: @"(\d+)". Examples of an invalid regex: @"\d+" | Required | | captureGroups | **array** | A dynamic array constant that indicates the capture group to extract. Valid values are from 1 to the number of capturing groups in the regular expression. | Required | | source | **string** | A string to search | Required | ### Returns * If regex finds a match in source: Returns dynamic array including all matches against the indicated capture groups captureGroups, or all of capturing groups in the regex. * If number of captureGroups is 1: The returned array has a single dimension of matched values. * If number of captureGroups is more than 1: The returned array is a two-dimensional collection of multi-value matches per captureGroups selection, or all capture groups present in the regex if captureGroups is omitted. * If there’s no match: `-1` ### Examples ```kusto extract_all(regex, [captureGroups,] source) ``` ```kusto ['sample-http-logs'] | project extract_match = extract_all(@"(\w)(\w+)(\w)", dynamic([1,3]), content_type) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%20%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20extract_match%20%3D%20extract_all%28%40%5C%22%28%5C%5Cw%29%28%5C%5Cw%2B%29%28%5C%5Cw%29%5C%22%2C%20dynamic%28%5B1%2C3%5D%29%2C%20content_type%29%22%2C%20%22queryOptions%22%3A%20%7B%22quickRange%22%3A%20%2290d%22%7D%7D) ```kusto extract_all(@"(\w)(\w+)(\w)", dynamic([1,3]), content_type) == [["t", "t"],["c","v"]] ``` ```kusto ['sample-http-logs'] | project extract_match = extract_all(@"(\w)(\w+)(\w)", pack_array(), content_type) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20project%20extract_match%20%3D%20extract_all\(%40%5C%22\(%5C%5Cw\)\(%5C%5Cw%2B\)\(%5C%5Cw\)%5C%22%2C%20pack_array\(\)%2C%20content_type\)%22%2C%22queryOptions%22%3A%7B%22quickRange%22%3A%2230d%22%7D%7D) ## format\_bytes() Formats a number as a string representing data size in bytes. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | --------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | value | **number** | a number to be formatted as data size in bytes | Required | | precision | **number** | Number of digits the value will be rounded to. (default value is zero) | Optional | | units | **string** | Units of the target data size the string formatting will use (base 2 suffixes: `Bytes`, `KiB`, `KB`, `MiB`, `MB`, `GiB`, `GB`, `TiB`, `TB`, `PiB`, `EiB`, `ZiB`, `YiB`; base 10 suffixes: `kB` `MB` `GB` `TB` `PB` `EB` `ZB` `YB`). If the parameter is empty the units will be auto-selected based on input value. | Optional | | base | **number** | Either 2 or 10 to specify whether the prefix is calculated using 1000s or 1024s for each type. (default value is 2) | Optional | ### Returns * A formatted string for humans ### Examples ```kusto format_bytes( 4000, number, "['id']", num_comments ) == "3.9062500000000 KB" ``` ```kusto format_bytes(value [, precision [, units [, base]]]) format_bytes(1024) == "1 KB" format_bytes(8000000, 2, "MB", 10) == "8.00 MB" ``` ```kusto ['github-issues-event'] | project formated_bytes = format_bytes( 4783549035, number, "['id']", num_comments ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27github-issues-event%27%5D%5Cn%7C%20project%20formated_bytes%20%3D%20format_bytes\(4783549035%2C%20number%2C%20%5C%22%5B%27id%27%5D%5C%22%2C%20num_comments\)%22%7D) ## format\_url() Formats an input string into a valid URL. This function will return a string that is a properly formatted URL. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | -------- | ----------- | ------------------------------------------ | ------------------------ | | url | **dynamic** | string input you want to format into a URL | Required | ### Returns * A string that represents a properly formatted URL. ### Examples ```kusto ['sample-http-logs'] | project formatted_url = format_url(dynamic({"scheme": "https", "host": "github.com", "path": "/axiomhq/next-axiom"}) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20formatted_url%20%3D%20format_url%28dynamic%28%7B%5C%22scheme%5C%22%3A%20%5C%22https%5C%22%2C%20%5C%22host%5C%22%3A%20%5C%22github.com%5C%22%2C%20%5C%22path%5C%22%3A%20%5C%22%2Faxiomhq%2Fnext-axiom%5C%22%7D%29%29%22%7D) ```kusto ['sample-http-logs'] | project formatted_url = format_url(dynamic({"scheme": "https", "host": "github.com", "path": "/axiomhq/next-axiom", "port": 443, "fragment": "axiom","user": "axiom", "password": "apl"})) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20project%20formatted_url%20%3D%20format_url%28dynamic%28%7B%5C%22scheme%5C%22%3A%20%5C%22https%5C%22%2C%20%5C%22host%5C%22%3A%20%5C%22github.com%5C%22%2C%20%5C%22path%5C%22%3A%20%5C%22%2Faxiomhq%2Fnext-axiom%5C%22%2C%20%5C%22port%5C%22%3A%20443%2C%20%5C%22fragment%5C%22%3A%20%5C%22axiom%5C%22%2C%20%5C%22user%5C%22%3A%20%5C%22axiom%5C%22%2C%20%5C%22password%5C%22%3A%20%5C%22apl%5C%22%7D%29%29%22%7D) * These are all the supported keys when using the `format_url` function: scheme, host, port, fragment, user, password, query. ## indexof() Reports the zero-based index of the first occurrence of a specified string within the input string. ### Arguments | **name** | **type** | **description** | **usage** | | ------------ | -------------- | ------------------------------------------------------------------------------- | --------- | | source | **string** | Input string | Required | | lookup | **string** | String to look up | Required | | start\_index | **text** | Search start position. | Optional | | length | **characters** | Number of character positions to examine. A value of -1 means unlimited length. | Optional | | occurrence | **number** | The number of the occurrence. Default 1. | Optional | ### Returns * Zero-based index position of lookup. * Returns -1 if the string isn’t found in the input. ### Examples ```kusto indexof( body, ['id'], 2, 1, number ) == "-1" ``` ```kusto indexof(source,lookup[,start_index[,length[,occurrence]]]) indexof () ``` ```kusto ['github-issues-event'] | project occurrence = indexof( body, ['id'], 23, 5, number ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27github-issues-event%27%5D%5Cn%7C%20project%20occurrence%20%3D%20indexof%28%20body%2C%20%5B%27id%27%5D%2C%2023%2C%205%2C%20number%20%29%22%7D) ## isempty() Returns `true` if the argument is an empty string or is null. ### Returns Indicates whether the argument is an empty string or isnull. ### Examples ```kusto isempty("") == true ``` ```kusto isempty([value]) ``` ```kusto ['github-issues-event'] | project empty = isempty(num_comments) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20empty%20%3D%20isempty%28num_comments%29%22%7D) ## isnotempty() Returns `true` if the argument isn’t an empty string, and it isn’t null. ### Examples ```kusto isnotempty("") == false ``` ```kusto isnotempty([value]) notempty([value]) -- alias of isnotempty ``` ```kusto ['github-issues-event'] | project not_empty = isnotempty(num_comments) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20not_empty%20%3D%20isnotempty%28num_comments%29%22%7D) ## isnotnull() Returns `true` if the argument is not null. ### Examples ```kusto isnotnull( num_comments ) == true ``` ```kusto isnotnull([value]) notnull([value]) - alias for `isnotnull` ``` ```kusto ['github-issues-event'] | project not_null = isnotnull(num_comments) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20not_null%20%3D%20isnotnull%28num_comments%29%22%7D) ## isnull() Evaluates its sole argument and returns a bool value indicating if the argument evaluates to a null value. ### Returns True or false, depending on whether or not the value is null. ### Examples ```kusto isnull(Expr) ``` ```kusto ['github-issues-event'] | project is_null = isnull(creator) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20is_null%20%3D%20isnull%28creator%29%22%7D) ## parse\_bytes() Parses a string including byte size units and returns the number of bytes ### Arguments | **name** | **type** | **description** | **Required or Optional** | | ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------ | | bytes\_string | **string** | A string formated defining the number of bytes | Required | | base | **number** | (optional) Either 2 or 10 to specify whether the prefix is calculated using 1000s or 1024s for each type. (default value is 2) | Required | ### Returns * The number of bytes or zero if unable to parse ### Examples ```kusto parse_bytes(bytes_string [, base]) parse_bytes("1 KB") == 1024 parse_bytes("1 KB", 10) == 1000 parse_bytes("128 Bytes") == 128 parse_bytes("bad data") == 0 ``` ```kusto ['github-issues-event'] | extend parsed_bytes = parse_bytes("300 KB", 10) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20parsed_bytes%20%3D%20%20parse_bytes%28%5C%22300%20KB%5C%22%2C%2010%29%22%7D) ```kusto ['github-issues-event'] | project parsed_bytes = parse_bytes("300 KB", 10) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20parsed_bytes%20%3D%20%20parse_bytes%28%5C%22300%20KB%5C%22%2C%2010%29%22%7D) ## parse\_json() Interprets a string as a JSON value and returns the value as dynamic. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | --------- | -------- | ------------------------ | -------------------------------------------------------------------- | | Json Expr | string | Required | Expression that will be used, also represents a JSON-formatted value | ### Returns An object of type json that is determined by the value of json: * If json is of type string, and is a properly formatted JSON string, then the string is parsed, and the value produced is returned. * If json is of type string, but it isn’t a properly formatted JSON string, then the returned value is an object of type dynamic that holds the original string value. ### Examples ```kusto parse_json(json) ``` ```kusto ['vercel'] | extend parsed = parse_json('{"name":"vercel", "statuscode":200, "region": { "route": "usage streams", "number": 9 }}') ``` ```kusto ['github-issues-event'] | extend parsed = parse_json(creator) | where isnotnull( parsed) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20parsed%20%3D%20parse_json%28creator%29%5Cn%7C%20where%20isnotnull%28parsed%29%22%7D) ## parse\_url() Parses an absolute URL `string` and returns an object contains `URL parts.` ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ------------------------------------------------------- | | URL | string | Required | A string represents a URL or the query part of the URL. | ### Returns An object of type dynamic that included the URL components: Scheme, Host, Port, Path, Username, Password, Query Parameters, Fragment. ### Examples ```kusto parse_url(url) ``` ```kusto ['sample-http-logs'] | extend ParsedURL = parse_url("https://www.example.com/path/to/page?query=example") | project Scheme = ParsedURL["scheme"], Host = ParsedURL["host"], Path = ParsedURL["path"], Query = ParsedURL["query"] ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20extend%20ParsedURL%20%3D%20parse_url%28%5C%22https%3A%2F%2Fwww.example.com%2Fpath%2Fto%2Fpage%3Fquery%3Dexample%5C%22%29%5Cn%7C%20project%20%5Cn%20%20Scheme%20%3D%20ParsedURL%5B%5C%22scheme%5C%22%5D%2C%5Cn%20%20Host%20%3D%20ParsedURL%5B%5C%22host%5C%22%5D%2C%5Cn%20%20Path%20%3D%20ParsedURL%5B%5C%22path%5C%22%5D%2C%5Cn%20%20Query%20%3D%20ParsedURL%5B%5C%22query%5C%22%5D%22%7D) * Result ```json { "Host": "www.example.com", "Path": "/path/to/page", "Query": { "query": "example" }, "Scheme": "https" } ``` ## parse\_urlquery() Returns a `dynamic` object contains the Query parameters. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | -------------------------------- | | Query | string | Required | A string represents a url query. | query: A string represents a url query ### Returns An object of type dynamic that includes the query parameters. ### Examples ```kusto parse_urlquery("a1=b1&a2=b2&a3=b3") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20extend%20ParsedURLQUERY%20%3D%20parse_urlquery%28%5C%22a1%3Db1%26a2%3Db2%26a3%3Db3%5C%22%29%22%7D) * Result ```json { "Result": { "a3": "b3", "a2": "b2", "a1": "b1" } } ``` ```kusto parse_urlquery(query) ``` ```kusto ['github-issues-event'] | project parsed = parse_urlquery("https://play.axiom.co/axiom-play-qf1k/query?qid=fUKgiQgLjKE-rd7wjy") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20parsed%20%3D%20parse_urlquery%28%5C%22https%3A%2F%2Fplay.axiom.co%2Faxiom-play-qf1k%2Fexplorer%3Fqid%3DfUKgiQgLjKE-rd7wjy%5C%22%29%22%7D) ## replace() Replace all regex matches with another string. ### Arguments * regex: The regular expression to search source. It can contain capture groups in '('parentheses')'. * rewrite: The replacement regex for any match made by matchingRegex. Use $0 to refer to the whole match, $1 for the first capture group, \$2 and so on for subsequent capture groups. * source: A string. ### Returns * source after replacing all matches of regex with evaluations of rewrite. Matches do not overlap. ### Examples ```kusto replace(regex, rewrite, source) ``` ```kusto ['sample-http-logs'] | project content_type, Comment = replace("[html]", "[censored]", method) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20project%20content_type%2C%20Comment%20%3D%20replace%28%5C%22%5Bhtml%5D%5C%22%2C%20%5C%22%5Bcensored%5D%5C%22%2C%20method%29%22%7D) ## replace\_regex() Replaces all regex matches with another string. ### Arguments * regex: The regular expression to search text. * rewrite: The replacement regex for any match made by *matchingRegex*. * text: A string. ### Returns source after replacing all matches of regex with evaluations of rewrite. Matches do not overlap. ### Examples ```kusto replace_regex(@'^logging', 'axiom', 'logging-data') ``` * Result ```json { "replaced": "axiom-data" } ``` ```kusto replace_regex(regex, rewrite, text) ``` ```kusto ['github-issues-event'] | extend replaced = replace_regex(@'^logging', 'axiom', 'logging-data') ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20project%20replaced_regex%20%3D%20replace_regex%28%40'%5Elogging'%2C%20'axiom'%2C%20'logging-data'%29%22%7D) ### Backreferences Backreferences match the same text as previously matched by a capturing group. With Backreferences, you can identify a repeated character or substring within a string. * Backreferences in APL is implemented using the `$` sign. #### Examples ```kusto ['github-issues-event'] | project backreferences = replace_regex(@'observability=(.+)', 'axiom=$1', creator) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%20%7C%20project%20backreferences%20%3D%20replace_regex\(%40'observability%3D\(.%2B\)'%2C%20'axiom%3D%241'%2C%20creator\)%22%7D) ## replace\_string() Replaces all string matches with another string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ----------------------------------------------------------------------- | | lookup | string | Required | A string which Axiom matches in `text` and replaces with `rewrite`. | | rewrite | string | Required | A string with which Axiom replaces parts of `text` that match `lookup`. | | text | string | Required | A string where Axiom replaces parts matching `lookup` with `rewrite`. | ### Returns `text` after replacing all matches of `lookup` with evaluations of `rewrite`. Matches don’t overlap. ### Examples ```kusto replace_string("github", "axiom", "The project is hosted on github") ``` * Result ```json { "replaced_string": "axiom" } ``` ```kusto replace_string(lookup, rewrite, text) ``` ```kusto ['sample-http-logs'] | extend replaced_string = replace_string("The project is hosted on github", "github", "axiom") | project replaced_string ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%20%22%5B%27sample-http-logs%27%5D%5Cn%7C%20extend%20replaced_string%20%3D%20replace_string%28%27github%27%2C%20%27axiom%27%2C%20%27The%20project%20is%20hosted%20on%20github%27%29%5Cn%7C%20project%20replaced_string%22%7D) ## reverse() Function reverses the order of the input Field. ### Arguments | **name** | **type** | **description** | **Required or Optional** | | -------- | -------- | ----------------- | ------------------------ | | Field | `string` | Field input value | Required | ### Returns The reverse order of a field value. ### Examples ```kusto reverse(value) ``` ```kusto project reversed = reverse("axiom") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20reversed_value%20%3D%20reverse%28'axiom'%29%22%7D) * Result ```json moixa ``` ## split() Splits a given string according to a given delimiter and returns a string array with the contained substrings. Optionally, a specific substring can be returned if exists. ### Arguments * source: The source string that will be split according to the given delimiter. * delimiter: The delimiter (Field) that will be used in order to split the source string. ### Returns * A string array that contains the substrings of the given source string that are delimited by the given delimiter. ### Examples ```kusto split(source, delimiter) ``` ```kusto project split_str = split("axiom_observability_monitoring", "_") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27github-issues-event%27%5D%5Cn%7C%20project%20split_str%20%3D%20split%28%5C%22axiom_observability_monitoring%5C%22%2C%20%5C%22_%5C%22%29%22%7D) * Result ```json { "split_str": ["axiom", "observability", "monitoring"] } ``` ## strcat() Concatenates between 1 and 64 arguments. If the arguments aren’t of string type, they'll be forcibly converted to string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ------------------------------- | | Expr | string | Required | Expressions to be concatenated. | ### Returns Arguments, concatenated to a single string. ### Examples ```kusto strcat(argument1, argument2[, argumentN]) ``` ```kusto ['github-issues-event'] | project stract_con = strcat( ['milestone.creator'], number ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20stract_con%20%3D%20strcat%28%20%5B'milestone.creator'%5D%2C%20number%20%29%22%7D) ```kusto ['github-issues-event'] | project stract_con = strcat( 'axiom', number ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20stract_con%20%3D%20strcat%28%20'axiom'%2C%20number%20%29%22%7D) * Result ```json { "stract_con": "axiom3249" } ``` ## strcat\_delim() Concatenates between 2 and 64 arguments, with delimiter, provided as first argument. * If arguments aren’t of string type, they'll be forcibly converted to string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | ------------ | -------- | ------------------------ | --------------------------------------------------- | | delimiter | string | Required | string expression, which will be used as separator. | | argument1 .. | string | Required | Expressions to be concatenated. | ### Returns Arguments, concatenated to a single string with delimiter. ### Examples ```kusto strcat_delim(delimiter, argument1, argument2[ , argumentN]) ``` ```kusto ['github-issues-event'] | project strcat = strcat_delim(":", actor, creator) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20strcat%20%3D%20strcat_delim%28'%3A'%2C%20actor%2C%20creator%29%22%7D) ```kusto project strcat = strcat_delim(":", "axiom", "monitoring") ``` * Result ```json { "strcat": "axiom:monitoring" } ``` ## strcmp() Compares two strings. The function starts comparing the first character of each string. If they are equal to each other, it continues with the following pairs until the characters differ or until the end of shorter string is reached. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ----------------------------------- | | string1 | string | Required | first input string for comparison. | | string2 | string | Required | second input string for comparison. | ### Returns Returns an integral value indicating the relationship between the strings: * When the result is 0: The contents of both strings are equal. * When the result is -1: the first character that does not match has a lower value in string1 than in string2. * When the result is 1: the first character that does not match has a higher value in string1 than in string2. ### Examples ```kusto strcmp(string1, string2) ``` ```kusto ['github-issues-event'] | extend cmp = strcmp( body, repo ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20cmp%20%3D%20strcmp%28%20body%2C%20repo%20%29%22%7D) ```kusto project cmp = strcmp( "axiom", "observability") ``` * Result ```json { "input_string": -1 } ``` ## strlen() Returns the length, in characters, of the input string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | -------- | -------- | ------------------------ | ---------------------------------------------------------- | | source | string | Required | The source string that will be measured for string length. | ### Returns Returns the length, in characters, of the input string. ### Examples ```kusto strlen(source) ``` ```kusto project str_len = strlen("axiom") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20project%20str_len%20%3D%20strlen\(%5C%22axiom%5C%22\)%22%7D) * Result ```json { "str_len": 5 } ``` ## strrep() Repeats given string provided amount of times. * In case if first or third argument is not of a string type, it will be forcibly converted to string. ### Arguments | **Name** | **Type** | **Required or Optional** | **Description** | | ---------- | -------- | ------------------------ | ----------------------------------------------------- | | value | Expr | Required | Inpute Expression | | multiplier | integer | Required | positive integer value (from 1 to 1024) | | delimiter | string | Optional | An optional string expression (default: empty string) | ### Returns * Value repeated for a specified number of times, concatenated with delimiter. * In case if multiplier is more than maximal allowed value (1024), input string will be repeated 1024 times. ### Examples ```kusto strrep(value,multiplier,[delimiter]) ``` ```kusto ['github-issues-event'] | extend repeat_string = strrep( repo, 5, "::" ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20repeat_string%20%3D%20strrep\(%20repo%2C%205%2C%20%5C%22%3A%3A%5C%22%20\)%22%7D) ```kusto project repeat_string = strrep( "axiom", 3, "::" ) ``` * Result ```json { "repeat_string": "axiom::axiom::axiom" } ``` ## substring() Extracts a substring from a source string starting from some index to the end of the string. ### Arguments * source: The source string that the substring will be taken from. * startingIndex: The zero-based starting character position of the requested substring. * length: A parameter that can be used to specify the requested number of characters in the substring. ### Returns A substring from the given string. The substring starts at startingIndex (zero-based) character position and continues to the end of the string or length characters if specified. ### Examples ```kusto substring(source, startingIndex [, length]) ``` ```kusto ['github-issues-event'] | extend extract_string = substring( repo, 4, 5 ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20extract_string%20%3D%20substring\(%20repo%2C%204%2C%205%20\)%22%7D) ```kusto project extract_string = substring( "axiom", 4, 5 ) ``` ```json { "extract_string": "m" } ``` ## toupper() Converts a string to upper case. ```kusto toupper("axiom") == "AXIOM" ``` ```kusto ['github-issues-event'] | project upper = toupper( body ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20upper%20%3D%20toupper\(%20body%20\)%22%7D) ## tolower() Converts a string to lower case. ```kusto tolower("AXIOM") == "axiom" ``` ```kusto ['github-issues-event'] | project low = tolower( body ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20low%20%3D%20tolower%28body%29%22%7D) ## trim() Removes all leading and trailing matches of the specified cutset. ### Arguments * source: A string. * cutset: A string containing the characters to be removed. ### Returns source after trimming matches of the cutset found in the beginning and/or the end of source. ### Examples ```kusto trim(source) ``` ```kusto ['github-issues-event'] | extend remove_leading_matches = trim( "locked", repo) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20remove_leading_matches%20%3D%20trim\(%5C%22locked%5C%22%2C%20repo\)%22%7D) ```kusto project remove_leading_matches = trim( "axiom", "observability") ``` * Result ```json { "remove_leading_matches": "bservability" } ``` ## trim\_regex() Removes all leading and trailing matches of the specified regular expression. ### Arguments * regex: String or regular expression to be trimmed from the beginning and/or the end of source. * source: A string. ### Returns source after trimming matches of regex found in the beginning and/or the end of source. ### Examples ```kusto trim_regex(regex, source) ``` ```kusto ['github-issues-event'] | extend remove_trailing_match_regex = trim_regex( "^github", action ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20extend%20remove_trailing_match_regex%20%3D%20trim_regex\(%5C%22%5Egithub%5C%22%2C%20action\)%22%7D) * Result ```json { "remove_trailing_match_regex": "closed" } ``` ## trim\_end() Removes trailing match of the specified cutset. ### Arguments * source: A string. * cutset: A string containing the characters to be removed.\` ### Returns source after trimming matches of the cutset found in the end of source. ### Examples ```kusto trim_end(source) ``` ```kusto ['github-issues-event'] | extend remove_cutset = trim_end(@"[^\w]+", body) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B%27github-issues-event%27%5D%5Cn%7C%20extend%20remove_cutset%20%3D%20trim_end%28%40%5C%22%5B%5E%5C%5Cw%5D%2B%5C%22%2C%20body%29%22%7D) * Result ```json { "remove_cutset": "In [`9128d50`](https://7aa98788e07\n), **down**:\n- HTTP code: 0\n- Response time: 0 ms\n" } ``` ## trim\_end\_regex() Removes trailing match of the specified regular expression. ### Arguments * regex: String or regular expression to be trimmed from the end of source. * source: A string. ### Returns source after trimming matches of regex found in the end of source. ### Examples ```kusto trim_end_regex(regex, source) ``` ```kusto ['github-issues-event'] | project remove_cutset_regex = trim_end_regex( "^github", creator ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20remove_cutset_regex%20%3D%20trim_end_regex\(%20%5C%22%5Egithub%5C%22%2C%20creator%20\)%22%7D) * Result ```json { "remove_cutset_regex": "axiomhq" } ``` ## trim\_start() Removes leading match of the specified cutset. ### Arguments * source: A string. ### Returns * source after trimming match of the specified cutset found in the beginning of source. ### Examples ```kusto trim_start(source) ``` ```kusto ['github-issues-event'] | project remove_cutset = trim_start( "github", repo) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20remove_cutset%20%3D%20trim_start\(%20%5C%22github%5C%22%2C%20repo\)%22%7D) * Result ```json { "remove_cutset": "axiomhq/next-axiom" } ``` ## trim\_start\_regex() Removes leading match of the specified regular expression. ### Arguments * regex: String or regular expression to be trimmed from the beginning of source. * source: A string. ### Returns source after trimming match of regex found in the beginning of source. ### Examples ```kusto trim_start_regex(regex, source) ``` ```kusto ['github-issues-event'] | project remove_cutset = trim_start_regex( "github", repo) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20remove_cutset%20%3D%20trim_start_regex\(%20%5C%22github%5C%22%2C%20repo\)%22%7D) * Result ```json { "remove_cutset": "axiomhq/next-axiom" } ``` ## url\_decode() The function converts encoded URL into a to regular URL representation. ### Arguments * `encoded url:` encoded URL (string). ### Returns URL (string) in a regular representation. ### Examples ```kusto url_decode(encoded url) ``` ```kusto ['github-issues-event'] | project decoded_link = url_decode( "https://www.axiom.co/" ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20decoded_link%20%3D%20url_decode\(%20%5C%22https%3A%2F%2Fwww.axiom.co%2F%5C%22%20\)%22%7D) * Result ```json { "decoded_link": "https://www.axiom.co/" } ``` ## url\_encode() The function converts characters of the input URL into a format that can be transmitted over the Internet. ### Arguments * url: input URL (string). ### Returns URL (string) converted into a format that can be transmitted over the Internet. ### Examples ```kusto url_encode(url) ``` ```kusto ['github-issues-event'] | project encoded_url = url_encode( "https://www.axiom.co/" ) ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20encoded_url%20%3D%20url_encode\(%20%5C%22https%3A%2F%2Fwww.axiom.co%2F%5C%22%20\)%22%7D) * Result ```json { "encoded_link": "https%3A%2F%2Fwww.axiom.co%2F" } ``` ## gettype() Returns the runtime type of its single argument. ### Arguments * Expressions ### Returns A string representing the runtime type of its single argument. ### Examples | **Expression** | **Returns** | | ----------------------------------------- | -------------- | | gettype("lima") | **string** | | gettype(2222) | **int** | | gettype(5==5) | **bool** | | gettype(now()) | **datetime** | | gettype(parse\_json('67')) | **int** | | gettype(parse\_json(' "polish" ')) | **string** | | gettype(parse\_json(' \{"axiom":1234} ')) | **dictionary** | | gettype(parse\_json(' \[6, 7, 8] ')) | **array** | | gettype(456.98) | **real** | | gettype(parse\_json('')) | **null** | ## parse\_csv() Splits a given string representing a single record of comma-separated values and returns a string array with these values. ### Arguments * csv\_text: A string representing a single record of comma-separated values. ### Returns A string array that contains the split values. ### Examples ```kusto parse_csv("axiom,logging,observability") == [ "axiom", "logging", "observability" ] ``` ```kusto parse_csv("axiom, processing, language") == [ "axiom", "processing", "language" ] ``` ```kusto ['github-issues-event'] | project parse_csv("github, body, repo") ``` [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'github-issues-event'%5D%5Cn%7C%20project%20parse_csv\(%5C%22github%2C%20body%2C%20repo%5C%22\)%22%7D)