countof_regex

This page explains how to use the countof_regex function in APL.

The countof_regex function counts occurrences of a regular expression pattern within a string. Use this function when you need to count complex patterns or character classes in log messages, requiring more flexibility than simple substring matching.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use rex with max_match to count regex matches. APL’s countof_regex provides a more straightforward approach.

Splunk example

| rex field=message max_match=0 "error|warning"
| eval pattern_count=mvcount(rex)

ANSI SQL users

In ANSI SQL, counting regex matches typically requires database-specific functions. APL’s countof_regex provides a standard approach.

SQL example

SELECT REGEXP_COUNT(field, 'pattern') AS count FROM logs;

Usage

Syntax

countof_regex(text, regex)

Parameters

Name	Type	Required	Description
text	string	Yes	The source string where pattern occurrences are counted.
regex	string	Yes	The regular expression pattern to search for within the text.

Returns

Returns the number of times the regex pattern matches in the text.

Use case examples

Log analysis

Count numeric patterns in URIs to identify parameterized endpoint usage.

Query

['sample-http-logs']
| extend numeric_params = countof_regex(uri, '[0-9]+')
| where numeric_params > 0
| summarize avg_params = avg(numeric_params), request_count = count() by method
| sort by request_count desc

Run in Playground

Output

method	avg_params	request_count
GET	1.8	3421
POST	1.2	1876
PUT	2.1	654
DELETE	1.5	234

This query counts numeric parameters in request URIs using regex, helping identify how frequently parameterized endpoints are accessed by different HTTP methods.

List of related functions

• countof: Counts plain substring occurrences. Use this when you need exact string matching without regex complexity.
• extract: Extracts the first substring matching a regex. Use this when you need to capture the matched text, not just count occurrences.
• extract_all: Extracts all substrings matching a regex. Use this when you need both the count and the actual matched values.
• replace_regex: Replaces all regex matches with another string. Use this when you need to modify matched patterns rather than count them.