split ↗

Use the split() function to divide a string into an array of substrings based on a specified delimiter.

Syntax

split (<value> [, <string_delimiter>])

Parameters

Name Type Required Description
value string Yes The string field or literal value to split.
string_delimiter string No The string literal used as the delimiter. If omitted or set to an empty string (""), a space (' ') is used by default.

Returns

The split() function returns an array of strings containing the substrings generated by splitting the input value.

Usage notes

  • The function operates exclusively on string inputs.
  • The delimiter itself is not included in the resulting array elements.
  • If the delimiter appears consecutively, or at the beginning or end of the string, it can result in empty strings as elements in the output array.
  • If the input value is NULL, the function returns an empty array [].

Examples

Example 1: Basic split with a specific delimiter

Goal: Split an IP address string by the dot (.) character to separate its octets.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102, 105)
| alter ip_octets = split(ipv4_address, ".")
| fields event_id, ipv4_address, ip_octets 
| limit 3

Explanation: The function divides the ipv4_address string into an array of individual numeric octets using the specified . delimiter.

Output:

EVENT_ID IPV4_ADDRESS IP_OCTETS
101 192.168.1.10 ["192", "168", "1", "10"]
102 10.0.0.5 ["10", "0", "0", "5"]
105 192.168.10.20 ["192", "168", "10", "20"]

Example 2: Split without a specified delimiter

Goal: Split a log message into individual words using the default delimiter (space).

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102)
| alter log_words = split(raw_log_data)
| fields event_id, raw_log_data, log_words 
| limit 2

Explanation: By omitting the optional delimiter argument, the function automatically uses a space to break the raw_log_data string into an array of words.

Output:

EVENT_ID RAW_LOG_DATA LOG_WORDS
101 User Alice logged in from 192.168.1.10 ["User", "Alice", "logged", "in", "from", "192.168.1.10"]
102 Process cmd.exe attempted to access /etc/passwd ["Process", "cmd.exe", "attempted", "to", "access", "/etc/passwd"]

Example 3: Split with an empty string as delimiter

Goal: Explicitly use an empty string as the delimiter, which defaults to splitting by space.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 101
| alter log_parts = split(raw_log_data, "")
| fields event_id, raw_log_data, log_parts 
| limit 1

Explanation: Providing an empty string "" for the delimiter results in the same behavior as omitting the delimiter; the string is split by spaces.

Output:

EVENT_ID RAW_LOG_DATA LOG_PARTS
101 User Alice logged in from 192.168.1.10 ["User", "Alice", "logged", "in", "from", "192.168.1.10"]

Example 4: Split on a delimiter not present in the string

Goal: Attempt to split a string using a delimiter that does not exist within that string.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 101
| alter no_split_example = split(event_description, "|")
| fields event_id, event_description, no_split_example 
| limit 1

Explanation: The function returns an array containing the original string as its single element because the pipe (|) character is not present in the event_description.

Output:

EVENT_ID EVENT_DESCRIPTION NO_SPLIT_EXAMPLE
101 User login successful ["User login successful"]

Example 5: Split on a field containing NULL values

Goal: Handle input fields that contain NULL values.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 105
| alter split_null_domain = split(dst_domain, ".")
| fields event_id, dst_domain, split_null_domain 
| limit 1

Explanation: When the input string field (for example, dst_domain for event ID 105) is NULL, the function returns an empty array.

Output:

EVENT_ID DST_DOMAIN SPLIT_NULL_DOMAIN
105 NULL []

Example 6: Combining split with arrayindex

Goal: Split a string and immediately extract a specific element from the resulting array.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102)
| alter ip_parts_array = split(ipv4_address, ".")
| alter first_octet_string = arrayindex(ip_parts_array, 0)
| fields event_id, ipv4_address, ip_parts_array, first_octet_string 
| limit 2

Explanation: The query first uses split() to tokenize the ipv4_address. Subsequently, arrayindex(..., 0) extracts the first element (the first octet) as a string.

Output:

EVENT_ID IPV4_ADDRESS IP_PARTS_ARRAY FIRST_OCTET_STRING
101 192.168.1.10 ["192", "168", "1", "10"] 192
102 10.0.0.5 ["10", "0", "0", "5"] 10