set_intersect

This page explains how to use the set_intersect function in APL.

Use the set_intersect function in APL to find common elements between two dynamic arrays. This function returns a new array that contains only the elements that appear in both input arrays, preserving the order from the first array and eliminating duplicates.

You can use set_intersect when you need to compare sets of values—for example, to find users who accessed two different URLs, or to identify traces that passed through multiple services. This function is especially useful for working with dynamic fields generated during aggregations or transformations.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

Splunk SPL does not have a direct equivalent to set_intersect, but you can achieve similar functionality using mvfilter with conditions based on a lookup or manually defined set. APL simplifies this process by offering a built-in array intersection function.

Splunk example

| eval A=split("apple,banana,cherry", ",")
| eval B=split("banana,cherry,dragonfruit", ",")
| eval C=mvfilter(match(A, B))

ANSI SQL users

ANSI SQL does not natively support array data types or set operations over arrays. To perform an intersection, you usually need to normalize the arrays using UNNEST or JOIN, which can be verbose. In APL, set_intersect performs this in a single step.

SQL example

-- Using PostgreSQL syntax
SELECT ARRAY(
  SELECT unnest(array['apple','banana','cherry'])
  INTERSECT
  SELECT unnest(array['banana','cherry','dragonfruit'])
);

Usage

Syntax

set_intersect(Array1, Array2)

Parameters

Name	Type	Description
Array1	dynamic	The first array to compare.
Array2	dynamic	The second array to compare.

Returns

A dynamic array containing elements that exist in both Array1 and Array2, in the order they appear in Array1, with duplicates removed.

Example

Use set_intersect to return the intersection of two arrays.

Query

['sample-http-logs']
| extend intersect = set_intersect(dynamic([1, 2, 3]), dynamic([2, 3, 4, 5]))

Run in Playground

Output

_time	together
May 22, 11:42:52	[2, 3]

List of related functions

• set_difference: Returns elements in the first array that are not in the second. Use it to find exclusions.
• set_has_element: Tests whether a set contains a specific value. Prefer it when you only need a Boolean result.
• set_union: Returns the union of two or more sets. Use it when you need any element that appears in at least one set instead of every set.