Skip to main content Link Menu Expand (external link) Document Search Copy Copied

Utility Functions - split

Table of contents
  1. split


  • split(variable, delim)

Split the input string.


search {from="-7d@d",to="@d"} sContent("@event_type","@azureSignIn")
let clientIP_failure=f("@azureSignIn.ipAddress")
let {_,s1,_,_}=split(clientIP_failure,".")

In the case above, let {_,s1,_,_}=split(clientIP_failure,".") generates a new column s1 between the first and second delimiter of the variable “clientIP_failure”.