translate

This page explains how to use the translate function in APL.

Use the translate function in APL (Axiom Processing Language) to substitute characters in a string, one by one, based on their position in two input lists. For every character in the input string that matches a character in the first list, translate replaces it with the character at the same position in the second list.

This function is useful when you want to:

• Replace specific characters without using complex regular expressions.
• Normalize text by mapping characters to a consistent format.
• Obfuscate or scrub data by transforming characters to placeholders.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you often use replace or gsub to transform string values. These functions support regular expressions and substring replacements, but they don’t directly support fixed-position character substitution.

In APL, translate lets you replace multiple characters in a string at once, based on positionally aligned character sets.

Splunk example

... | eval masked_id=replace(id, "[abc]", "x")

ANSI SQL users

If you’re familiar with ANSI SQL, APL’s translate function works like SQL’s TRANSLATE. Both functions take a character source set, a target set, and a string to process.

SQL example

SELECT TRANSLATE(id, 'abc', 'xyz') FROM sample_http_logs;

Usage

Syntax

translate(searchList, replacementList, source)

Parameters

Name	Type	Description
searchList	string	Characters to search for in the input string.
replacementList	string	Characters to replace each match in searchList.
source	string	The input string to evaluate.

Returns

A string with characters from searchList replaced by corresponding characters in replacementList. If replacementList is shorter than searchList, Axiom repeatedly uses the last character of replacementList to match the length of the search.

Use case examples

Log analysis

Use translate to mask user IDs by replacing all lowercase letters with asterisks.

Query

['sample-http-logs']
| extend masked_id = translate('0123456789abcdefghijklmnopqrstuvwxyz', '##########*', id)
| project _time, id, masked_id

Run in Playground

Output

_time	id	masked_id
2025-07-28T12:34:56Z	bd6d8f17-2b8d-4b71-af20-f23dc8d20202	**#*#*##-#*#*-#*##-**##-*##**#*#####
2025-07-28T12:35:01Z	1e317368-9ed4-4e8c-b535-b59a68ffda05	#*######-#**#-#*#*-*###-*##*##****##

This query masks characters in the id field by replacing numbers with hashes and letters with asterisks.