Introduction
Theiff function evaluates a single Boolean predicate and returns one of two values depending on the result. Use it to add binary flag columns, choose between two computed expressions, or conditionally override a value in one step.
The iif function is an alias for iff and behaves identically. For three or more branches, use case instead.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
Splunk SPL uses
if(condition, value_if_true, value_if_false) inside an eval command. APL’s iff takes the same three arguments in the same order.ANSI SQL users
ANSI SQL users
SQL Server provides
IIF(condition, value_if_true, value_if_false), which maps directly to APL’s iff. In ANSI SQL you can also write CASE WHEN condition THEN value_if_true ELSE value_if_false END, which is equivalent.Usage
Syntax
Parameters
Returns
The value ofifTrue when predicate evaluates to true, or ifFalse otherwise.
To return a null value from
iff, use dynamic(null).Use case examples
- Log analysis
- OpenTelemetry traces
Flag requests that take longer than one second to identify slow endpoints.QueryRun in PlaygroundOutput
The query adds a
is_slow column to each request and then counts how many fall into each category.List of related functions
- case: Multi-branch conditional that evaluates a list of conditions and returns the first matching result. Use
casewhen you have three or more outcomes. - coalesce: Returns the first non-null value from a list of expressions. Use
coalescewhen you want to fall back from null rather than branch on a condition.