array_rotate_right

This page explains how to use the array_rotate_right function in APL.

The array_rotate_right function in APL allows you to rotate the elements of an array to the right by a specified number of positions. This function is useful when you need to reorder data within arrays, either to shift recent events to the beginning, reorder log entries, or realign elements based on specific processing logic.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In APL, the array_rotate_right function provides functionality similar to the use of mvindex or specific SPL commands for reordering arrays. The rotation here shifts all elements by a set count to the right, maintaining their original order within the new positions.

Splunk example

| eval rotated_array=mvindex(array, -3)

ANSI SQL users

ANSI SQL lacks a direct function for rotating elements within arrays. In APL, the array_rotate_right function offers a straightforward way to accomplish this by specifying a rotation count, while SQL users typically require a more complex use of CASE statements or custom functions to achieve the same.

SQL example

-- No direct ANSI SQL equivalent for array rotation

Usage

Syntax

array_rotate_right(array, count)

Parameters

• array: An array to rotate.
• count: An integer specifying the number of positions to rotate the array to the right.

Returns

An array where the elements are rotated to the right by the specified count.

Use case example

In OpenTelemetry traces, rotating an array of span details can help you reorder trace information for performance tracking or troubleshooting.

Query

['otel-demo-traces']
| extend rotated_sequence = array_rotate_right(events, 1)

Run in Playground

Output

events

[
  {
    "attributes": null,
    "name": "Enqueued",
    "timestamp": 1733997421220380700
  },
  {
    "name": "Sent",
    "timestamp": 1733997421220390400,
    "attributes": null
  },
  {
    "attributes": null,
    "name": "ResponseReceived",
    "timestamp": 1733997421221118500
  }
]

rotated_sequence

[
  {
    "attributes": null,
    "name": "ResponseReceived",
    "timestamp": 1733997421221118500
  },
  {
    "attributes": null,
    "name": "Enqueued",
    "timestamp": 1733997421220380700
  },
  {
    "name": "Sent",
    "timestamp": 1733997421220390400,
    "attributes": null
  }
]

List of related functions

• array_length: Returns the number of elements in an array.
• array_index_of: Finds the index of an element in an array.
• array_rotate_left: Rotates elements of an array to the left.