The if() function is now available in NRQL!

Conditional IF function

We’re excited to announce that you can now add conditionals to your NRQL using IF!
Finally you can change your TRUE / FALSE statements into 1s and 0s, or set up a decision tree of results to manipulate your data as you see fit.

The if function allows you to perform if-then-else control-flow operations throughout your query:

if(<true/false expression>, <true value>, [false value])
if(<t/f expression1> AND <t/f expression2>, <true value>, [false value])

NOTE: You can now use an AND/OR operator within any function without having to have a WHERE clause at the beginning. :tada:

Example 1:

FROM Transaction SELECT if(duration < 1, 'FAST', 'Slow')

Example 2:

FROM Transaction SELECT count(*)
FACET if(appName LIKE '%java%', 'Java',
      if(appName LIKE 'kafka', 'Kafka', 'Other') )

Conditional functions are particularly useful when you are parsing out values from a string and need to create a decision tree to get the data you need. See the post on Anchor Parse & NRQL Variables for more context.

Example 3:
Example strings:

WITH  aparse(`cs-url-stem`,'*/*') AS (object, value1),
   aparse(value1, '*/*') AS (objectid, value2),
   if(objectid IS NULL, value1, value2) AS subobject
SELECT count(*) FROM Log 
FACET object, subobject

In this example we need to parse a website link from a Log, then FACET by the page. The issue is that the format of the url can sometimes have an ID in it. Using if() we can make a decision tree to extract the subobject name we care about, and exclude the ID when it is present.

We’re excited to finally have a conditional operator as we know there are a multitude of ways you can use this function to help you transform, aggregate, and simplify your dashboards and alerts.

Related articles:
Regex Multi-Capture
Anchor Parse & NRQL Variables

Click here for NRQL Documentation on Conditional IF.