On This Page

Home / Search/ Language Reference/ Functions/ Scalar Functions/ String Functions/split

split

The split function splits a given string according to a given delimiter and returns a string array with the contained substrings. Optionally, a specific substring can be returned if it exists.

Syntax
​

    split( Source, Delimiter [, RequestedIndex] )

Arguments
​

  • Source: The source string that will be split according to the given delimiter.
  • Delimiter: The delimiter that will be used to split the source string.
  • RequestedIndex: An optional zero-based index int. If provided, the returned string array will contain the requested substring if it exists.

Results
​

A string array that contains the substrings of the given source string that are delimited by the given delimiter.

Examples
​

  • split("aa_bb", "_") returns as ["aa","bb"]
  • split("aaa_bbb_ccc", "_", 1) returns as ["bbb"]
  • split("", "_") returns as [""]
  • split("a__b", "_") returns as ["a","","b"]
  • split("aabbcc", "bb") returns as ["aa","cc"]

Example Query: Isolate IP Address Octets
​

dataset=$vt_dummy
| extend ip = '101.33.42.99'
| extend octets = split(ip, '.'), first_octet = split(ip, '.', 0), last_octet = split(ip, '.', 3)
Run in Cribl Search

Example Query: Isolate Filename Extension
​

dataset=$vt_dummy
| extend filename = 'awesome.log'
| extend basename = split(filename, '.', 0)
Run in Cribl Search