countof function counts the occurrences of a plain substring within a string. Use this function when you need to find how many times a specific text pattern appears in log messages, user input, or any string field without using regular expressions.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
In Splunk SPL, you might use a combination of
rex and counting operations. APL’s countof provides a simpler approach for counting plain string occurrences.ANSI SQL users
ANSI SQL users
In ANSI SQL, you typically calculate string occurrences using length differences. APL’s
countof provides a more direct approach.Usage
Syntax
Parameters
Returns
Returns the number of times the search string appears in the text.Use case examples
- Log analysis
- OpenTelemetry traces
- Security logs
Count how many times specific HTTP methods appear in URIs to identify API usage patterns.QueryRun in PlaygroundOutput
This query counts the number of forward slashes in URIs to determine the average API endpoint depth by HTTP method, helping identify API structure complexity.
List of related functions
- countof_regex: Counts substring occurrences using regular expressions. Use this when you need pattern matching instead of exact string matching.
- strlen: Returns the length of a string. Use this when you need the total character count rather than occurrence counting.
- indexof: Finds the position of the first occurrence of a substring. Use this when you need to know where a substring appears, not how many times.
- extract: Extracts substrings using regular expressions. Use this when you need to capture matched text rather than count occurrences.