strlen

This page explains how to use the strlen function in APL.

The strlen function returns the length of a string in characters. Use this function to validate field lengths, filter by size constraints, or analyze text content patterns in your logs.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use the len function. APL’s strlen provides the same functionality.

Splunk example

| eval length=len(field)

ANSI SQL users

In ANSI SQL, you use LENGTH or LEN depending on the database. APL’s strlen provides standardized string length measurement.

SQL example

SELECT LENGTH(field) AS length FROM logs;

Usage

Syntax

strlen(source)

Parameters

Name	Type	Required	Description
source	string	Yes	The string to measure.

Returns

Returns the length of the string in characters (not bytes).

Use case examples

Log analysis

Analyze URI lengths to identify potential long-URL attacks or data exfiltration attempts.

Query

['sample-http-logs']
| extend uri_length = strlen(uri)
| summarize avg_length = avg(uri_length),
            max_length = max(uri_length),
            long_uri_count = countif(uri_length > 200) by method, status
| sort by max_length desc
| limit 10

Run in Playground

Output

method	status	avg_length	max_length	long_uri_count
GET	200	45.3	512	234
POST	404	38.7	387	89

This query analyzes URI length patterns to identify unusually long requests that might indicate attacks or data exfiltration attempts.

List of related functions

• substring: Extracts parts of strings. Use this with strlen to extract specific length substrings.
• isempty: Checks if a string is empty. Use this to test for zero-length strings more explicitly.
• countof: Counts substring occurrences. Use this when you need occurrence counts rather than total length.
• format_bytes: Formats bytes as strings. Use this to format length values for display.