parse_bytes

This page explains how to use the parse_bytes function in APL.

The parse_bytes function parses a string representation of data size (like ‘1 KB’, ‘500 MB’) and returns the numeric value in bytes. Use this function to convert human-readable byte strings from logs or configuration files into numeric values for calculations and comparisons.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you typically need custom eval expressions to parse byte strings. APL’s parse_bytes provides this functionality natively.

Splunk example

| eval bytes=case(
    match(size_str, "KB"), tonumber(replace(size_str, " KB", "")) * 1024,
    match(size_str, "MB"), tonumber(replace(size_str, " MB", "")) * 1048576,
    true(), 0)

ANSI SQL users

In ANSI SQL, parsing byte strings requires complex CASE statements. APL’s parse_bytes simplifies this operation.

SQL example

SELECT CASE 
  WHEN size_str LIKE '%KB%' THEN CAST(REPLACE(size_str, ' KB', '') AS FLOAT) * 1024
  WHEN size_str LIKE '%MB%' THEN CAST(REPLACE(size_str, ' MB', '') AS FLOAT) * 1048576
  ELSE 0
END AS bytes FROM logs;

Usage

Syntax

parse_bytes(bytes_string, base)

Parameters

Name	Type	Required	Description
bytes_string	string	Yes	A string representing a data size with units (e.g., ‘1 KB’, ‘500 MB’, ‘2 GB’).
base	int	No	Either 2 (default, 1024-based) or 10 (1000-based) for unit calculations.

Returns

Returns the numeric value in bytes, or 0 if the string cannot be parsed.

Use case examples

Log analysis

Parse human-readable size strings to analyze and aggregate data transfer volumes.

Query

['sample-http-logs']
| extend size_bytes = parse_bytes('512 KB')
| where req_duration_ms > 100
| summarize total_bytes = sum(size_bytes), request_count = count() by status
| sort by total_bytes desc
| limit 10

Run in Playground

Output

status	total_bytes	request_count
200	4587520	8765
500	1048576	2341
404	524288	1234

This query parses size strings to calculate total data transfer by HTTP status code, enabling volume-based analysis of API usage.

List of related functions

• format_bytes: Formats numeric bytes as human-readable strings. Use this to reverse the parsing operation.
• strlen: Returns the length of a string. Use this when you need string length rather than byte parsing.