cursor_current

This page explains how to use the cursor_current function in APL.

Use the cursor_current function in APL to retrieve a cursor string that represents the current point in the query execution. A cursor is a unique identifier that marks a specific position in your data stream, allowing you to resume queries from that exact point in subsequent executions.

You use cursor_current when implementing incremental data processing, change data capture (CDC) patterns, or any scenario where you need to track the last processed position in your data. This is particularly useful for building efficient data synchronization pipelines, continuous monitoring systems, and incremental analytics workflows.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you typically use time-based bookmarks or the _indextime field to track processing positions. APL’s cursor_current provides a more robust cursor mechanism that works across query executions and handles distributed data more reliably.

Splunk example

| stats max(_indextime) as last_processed

ANSI SQL users

In ANSI SQL, you typically use MAX(timestamp) or row IDs to track the last processed record. APL’s cursor_current provides a system-level cursor that captures the exact query execution position, which is more reliable for distributed systems.

SQL example

SELECT MAX(timestamp) as last_processed_time
FROM logs

Usage

Syntax

cursor_current()

Parameters

This function takes no parameters.

Returns

A string representing a cursor that marks the current position in the query execution. This cursor can be stored and used in subsequent queries to resume processing from the same point.

Use case examples

Log analysis

Use cursor_current to track the last processed position when implementing incremental log processing pipelines.

Query

['sample-http-logs']
| extend processing_cursor = cursor_current()
| where status != '200'
| summarize error_count = count(), last_cursor = make_list(processing_cursor)[0] by bin(_time, 5m)
| take 5

Run in Playground

Output

error_count	last_cursor
343,769	0ddnv2035n4lc-082f23975a003f6b-00006d10

This query captures cursor positions alongside error counts, allowing you to resume processing from the last successful position in case of failures or for incremental updates.

List of related functions

• ingestion_time: Use ingestion_time to get the time when data was ingested. Use cursor_current for resumable query execution tracking.
• now: Use now to get the current query execution time. Use cursor_current for position tracking in data streams.
• bin: Use bin to group data into time buckets. Use cursor_current alongside bin for checkpointed time-series processing.