Skip to main content
The strcat_delim function concatenates between 2 and 64 arguments with a specified delimiter between each argument. Use this function to build delimited strings like CSV rows, create formatted lists, or join fields with consistent separators.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically concatenate with repeated delimiters. APL’s strcat_delim provides a more concise approach.
| eval combined=field1.",".field2.",".field3
In ANSI SQL, you use CONCAT_WS (concat with separator) for delimited concatenation. APL’s strcat_delim provides similar functionality.
SELECT CONCAT_WS(',', field1, field2, field3) AS combined FROM logs;

Usage

Syntax

strcat_delim(delimiter, arg1, arg2, ..., argN)

Parameters

NameTypeRequiredDescription
delimiterstringYesThe separator string to insert between arguments.
arg1, arg2, …, argNanyYesBetween 2 and 64 expressions to concatenate. Non-string values are converted to strings.

Returns

Returns all arguments concatenated with the delimiter between each argument.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Create CSV-formatted log records for export or integration with external systems.Query
['sample-http-logs']
| extend csv_record = strcat_delim(',', method, status, uri, req_duration_ms, ['geo.country'])
| project _time, csv_record
| limit 10
Run in PlaygroundOutput
_timecsv_record
2024-11-06T10:00:00ZGET,200,/api/users,145,United States
2024-11-06T10:01:00ZPOST,201,/api/orders,234,United Kingdom
This query formats log fields as CSV records with comma delimiters, making them ready for export to spreadsheet applications or data warehouses.
  • strcat: Concatenates strings without delimiters. Use this when you want direct concatenation or need custom separators for each position.
  • split: Splits strings by delimiters. Use this to reverse strcat_delim operations and extract individual fields.
  • parse_csv: Parses CSV strings. Use this to parse the output of strcat_delim with comma delimiters.
  • format_url: Formats URLs from components. Use this specifically for URL construction rather than general delimited concatenation.