strcat

This page explains how to use the strcat function in APL.

The strcat function concatenates between 1 and 64 string arguments into a single string. Use this function to combine multiple fields, build composite identifiers, or construct formatted messages from log data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you concatenate strings using the . operator or the concat function. APL’s strcat provides similar functionality.

Splunk example

| eval combined=field1."-".field2."-".field3

ANSI SQL users

In ANSI SQL, you use CONCAT to join strings. APL’s strcat provides the same functionality.

SQL example

SELECT CONCAT(field1, '-', field2, '-', field3) AS combined FROM logs;

Usage

Syntax

strcat(arg1, arg2, ..., argN)

Parameters

Name	Type	Required	Description
arg1, arg2, …, argN	any	Yes	Between 1 and 64 expressions to concatenate. Non-string values are converted to strings.

Returns

Returns all arguments concatenated into a single string.

Use case examples

Log analysis

Build composite keys from multiple fields for unique request identification.

Query

['sample-http-logs']
| extend request_key = strcat(method, '-', status, '-', ['geo.country'])
| summarize request_count = count() by request_key
| sort by request_count desc
| limit 10

Run in Playground

Output

request_key	request_count
GET-200-United States	3456
POST-201-United States	2341
GET-404-Unknown	1987

This query concatenates HTTP method, status, and country to create composite keys for analyzing request patterns by multiple dimensions.

List of related functions

• strcat_delim: Concatenates strings with a delimiter. Use this when you want consistent separators between all arguments.
• split: Splits strings into arrays. Use this to reverse concatenation operations.
• replace_string: Replaces parts of strings. Use this when you need to modify concatenated strings.
• format_url: Formats URL components. Use this specifically for URL construction rather than general concatenation.