countof

This page explains how to use the countof function in APL.

The countof function counts the occurrences of a plain substring within a string. Use this function when you need to find how many times a specific text pattern appears in log messages, user input, or any string field without using regular expressions.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you might use a combination of rex and counting operations. APL’s countof provides a simpler approach for counting plain string occurrences.

Splunk example

| rex field=message max_match=0 "error"
| eval error_count=mvcount(error)

ANSI SQL users

In ANSI SQL, you typically calculate string occurrences using length differences. APL’s countof provides a more direct approach.

SQL example

SELECT (LENGTH(field) - LENGTH(REPLACE(field, 'search', ''))) / LENGTH('search') AS count FROM logs;

Usage

Syntax

countof(text, search)

Parameters

Name	Type	Required	Description
text	string	Yes	The source string where occurrences are counted.
search	string	Yes	The plain substring to search for within the text.

Returns

Returns the number of times the search string appears in the text.

Use case examples

Log analysis

Count how many times specific HTTP methods appear in URIs to identify API usage patterns.

Query

['sample-http-logs']
| extend api_segments = countof(uri, '/')
| summarize avg_depth = avg(api_segments), request_count = count() by method
| sort by request_count desc

Run in Playground

Output

method	avg_depth	request_count
GET	3.2	5432
POST	2.8	2341
PUT	2.5	876
DELETE	2.1	234

This query counts the number of forward slashes in URIs to determine the average API endpoint depth by HTTP method, helping identify API structure complexity.

List of related functions

• countof_regex: Counts substring occurrences using regular expressions. Use this when you need pattern matching instead of exact string matching.
• strlen: Returns the length of a string. Use this when you need the total character count rather than occurrence counting.
• indexof: Finds the position of the first occurrence of a substring. Use this when you need to know where a substring appears, not how many times.
• extract: Extracts substrings using regular expressions. Use this when you need to capture matched text rather than count occurrences.