Skip to content

Add array_sort_asc, array_sort_desc, totitle, base64_decode_toarray, base64_encode_fromarray #325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apl/scalar-functions/array-functions.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ The table summarizes the array functions available in APL.
| [array_shift_left](/apl/scalar-functions/array-functions/array-shift-left) | Shifts the values inside a dynamic array to the left. |
| [array_shift_right](/apl/scalar-functions/array-functions/array-shift-right) | Shifts values inside an array to the right. |
| [array_slice](/apl/scalar-functions/array-functions/array-slice) | Extracts a slice of a dynamic array. |
| [array_sort_asc](/apl/scalar-functions/array-functions/array-sort-asc) | Sorts an array in ascending order. |
| [array_sort_desc](/apl/scalar-functions/array-functions/array-sort-desc) | Sorts an array in descending order. |
| [array_split](/apl/scalar-functions/array-functions/array-split) | Splits an array to multiple arrays according to the split indices and packs the generated array in a dynamic array. |
| [array_sum](/apl/scalar-functions/array-functions/array-sum) | Calculates the sum of elements in a dynamic array. |
| [bag_has_key](/apl/scalar-functions/array-functions/bag-has-key) | Checks whether a dynamic property bag contains a specific key. |
Expand Down
103 changes: 103 additions & 0 deletions apl/scalar-functions/array-functions/array-sort-asc.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
---
title: array_sort_asc
description: 'This page explains how to use the array_sort_asc function in APL.'
---

Use the `array_sort_asc` function to return a new array that contains all the elements of the input array, sorted in ascending order. This function is useful when you want to normalize the order of array elements for comparison, presentation, or further processing—such as identifying patterns, comparing sequences, or selecting boundary values.

You can apply `array_sort_asc` to arrays of numbers, strings, or dynamic objects, making it useful across many telemetry, logging, and security data scenarios.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
<Accordion title="Splunk SPL users">

In Splunk SPL, arrays are typically handled through `mvsort`, which sorts multivalue fields in ascending order. In APL, `array_sort_asc` provides similar functionality but works on dynamic arrays and returns a new sorted array.

<CodeGroup>
```sql Splunk example
| eval sorted_values = mvsort(multivalue_field)
````

```kusto APL equivalent
datatable(arr: dynamic)
[
dynamic([4, 2, 5])
]
| extend sorted_arr = array_sort_asc(arr)
```

</CodeGroup>

</Accordion>
<Accordion title="ANSI SQL users">

ANSI SQL does not directly support array data types or array sorting. You typically normalize arrays with `UNNEST` and sort the results using `ORDER BY`. In APL, you can sort arrays inline using `array_sort_asc`, which is more concise and expressive.

<CodeGroup>
```sql SQL example
SELECT val
FROM UNNEST([4, 2, 5]) AS val
ORDER BY val ASC
```

```kusto APL equivalent
print sorted_arr = array_sort_asc(dynamic([4, 2, 5]))
```

</CodeGroup>

</Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto
array_sort_asc(array)
```

### Parameters

| Name | Type | Required | Description |
| ----- | ------- | -------- | ------------------------------------------------------------------------- |
| array | dynamic | ✔️ | An array of values to sort. Can be numbers, strings, or other primitives. |

### Returns

A new array that contains the same elements as the input array, sorted in ascending order. If the input is not an array, the function returns an empty array.

## Example

**Query**

```kusto
['sample-http-logs']
| project sort = array_sort_asc(dynamic(['x', 'a', 'm', 'o', 'i']))
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20project%20sort%20%3D%20array_sort_asc(dynamic(%5B'x'%2C%20'a'%2C%20'm'%2C%20'o'%2C%20'i'%5D))%22%7D)

**Output**

```json
[
[
"a",
"i",
"m",
"o",
"x"
]
]
```

## List of related functions

- [array_index_of](/apl/scalar-functions/array-functions/array-index-of): Returns the position of an element in an array. Use after sorting to find where values fall.
- [array_length](/apl/scalar-functions/array-functions/array-length): Returns the number of elements in an array. Use to understand array size before or after sorting.
- [array_slice](/apl/scalar-functions/array-functions/array-slice): Returns a subrange of the array. Useful after sorting to get top-N or bottom-N elements.
- [array_sort_desc](/apl/scalar-functions/array-functions/array-sort-desc): Sorts array elements in descending order. Use when you need reverse ordering.
104 changes: 104 additions & 0 deletions apl/scalar-functions/array-functions/array-sort-desc.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
---
title: array_sort_desc
description: 'This page explains how to use the array_sort_desc function in APL.'
---

Use the `array_sort_desc` function in APL to sort the elements of an array in descending order. This function is especially useful when working with numerical data or categorical data where you want to prioritize higher values first—such as showing the longest durations, highest response times, or most severe error codes at the top of an array.

You can use `array_sort_desc` in scenarios where ordering matters within grouped aggregations, such as collecting response times per user or span durations per trace, and then sorting them to identify the highest or most impactful values.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
<Accordion title="Splunk SPL users">

Splunk doesn’t have a direct equivalent to `array_sort_desc`, but similar outcomes can be achieved using `mvsort` with a custom sort order (and sometimes `reverse`). In APL, `array_sort_desc` explicitly performs a descending sort on array elements, making it more straightforward.

<CodeGroup>
```sql Splunk example
... | stats list(duration) as durations by id
... | eval durations=reverse(mvsort(durations))
````

```kusto APL equivalent
['otel-demo-traces']
| summarize durations=make_list(duration) by trace_id
| extend durations=array_sort_desc(durations)
```

</CodeGroup>

</Accordion>
<Accordion title="ANSI SQL users">

ANSI SQL does not support arrays or array functions natively. You typically use window functions or subqueries to order values. In APL, you can work with arrays directly and apply `array_sort_desc` to sort them.

<CodeGroup>
```sql SQL example
SELECT trace_id, ARRAY_AGG(duration ORDER BY duration DESC) AS durations
FROM traces
GROUP BY trace_id;
```

```kusto APL equivalent
['otel-demo-traces']
| summarize durations=make_list(duration) by trace_id
| extend durations=array_sort_desc(durations)
```

</CodeGroup>

</Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto
array_sort_desc(array)
```

### Parameters

| Name | Type | Required | Description |
| ----- | ----- | -------- | ----------------------------------------------------- |
| array | array | ✔️ | The input array whose elements are sorted descending. |

### Returns

If the input is a valid array, the function returns a new array with its elements sorted in descending order. If the array is empty or contains incompatible types, it returns an empty array.

## Example

**Query**

```kusto
['sample-http-logs']
| project sort = array_sort_desc(dynamic(['x', 'a', 'm', 'o', 'i']))
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20project%20sort%20%3D%20array_sort_desc(dynamic(%5B'x'%2C%20'a'%2C%20'm'%2C%20'o'%2C%20'i'%5D))%22%7D)

**Output**

```json
[
[
"x",
"o",
"m",
"i",
"a"
]
]
```

## List of related functions

- [array_index_of](/apl/scalar-functions/array-functions/array-index-of): Returns the index of a value in an array. Useful after sorting to locate specific elements.
- [array_length](/apl/scalar-functions/array-functions/array-length): Returns the number of elements in an array. Useful for measuring the size of arrays before or after sorting.
- [array_slice](/apl/scalar-functions/array-functions/array-slice): Extracts a range of elements from an array. Use it after sorting to get the top N or bottom N values.
- [array_sort_asc](/apl/scalar-functions/array-functions/array-sort-asc): Sorts an array in ascending order. Use this when you want to prioritize smaller values first.
Loading
Loading