set_difference

This page explains how to use the set_difference function in APL.

Use the set_difference function in APL to compute the distinct elements in one array that are not present in another. This function helps you filter out shared values between two arrays, producing a new array that includes only the unique values from the first input array.

Use set_difference when you need to identify new or missing elements, such as:

• Users who visited today but not yesterday.
• Error codes that occurred in one region but not another.
• Service calls that appear in staging but not production.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, similar logic often uses the setdiff function from the mv (multivalue) function family. APL’s set_difference behaves similarly, returning values that are only in the first multivalue field.

Splunk example

| eval a=mvappend("a", "b", "c"), b=mvappend("b", "c")
| eval diff=mvfilter(NOT match(a, b))

ANSI SQL users

ANSI SQL doesn’t support array operations directly, but you can emulate set difference with EXCEPT when working with rows, not arrays. APL provides native array functions like set_difference for this purpose.

SQL example

SELECT value FROM array1
EXCEPT
SELECT value FROM array2;

Usage

Syntax

set_difference(Array1, Array2)

Parameters

Name	Type	Description
Array1	array	The array to subtract from.
Array2	array	The array containing values to remove from Array1.

Returns

An array that includes all values from Array1 that are not present in Array2. The result does not include duplicates.

Example

Use set_difference to return the difference between two arrays.

Query

['sample-http-logs']
| extend difference = set_difference(dynamic([1, 2, 3]), dynamic([2, 3, 4, 5]))

Run in Playground

Output

_time	difference
May 22, 11:42:52	[5, 1, 4]

List of related functions

• set_difference: Returns elements in the first array that are not in the second. Use it to find exclusions.
• set_has_element: Tests whether a set contains a specific value. Prefer it when you only need a Boolean result.
• set_union: Returns the union of two or more sets. Use it when you need any element that appears in at least one set instead of every set.