split

Use the `split()` function to divide a string into an array of substrings based on a specified delimiter.

## Syntax

```sql
split (<value> [, <string_delimiter>])
```

## Parameters

| Name | Type | Required | Description |
| ------------------ | ------ | -------- | -------------------------------------------------------------------------------------------------------------------------- |
| `value` | string | Yes | The string field or literal value to split. |
| `string_delimiter` | string | No | The string literal used as the delimiter. If omitted or set to an empty string (`""`), a space (`' '`) is used by default. |

## Returns

The `split()` function returns an array of strings containing the substrings generated by splitting the input value.

## Usage notes

* The function operates exclusively on string inputs.
* The delimiter itself is not included in the resulting array elements.
* If the delimiter appears consecutively, or at the beginning or end of the string, it can result in empty strings as elements in the output array.
* If the input `value` is NULL, the function returns an empty array `[]`.

## Examples

### Example 1: Basic split with a specific delimiter

**Goal**: Split an IP address string by the dot (`.`) character to separate its octets.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102, 105)
| alter ip_octets = split(ipv4_address, ".")
| fields event_id, ipv4_address, ip_octets 
| limit 3
```

**Explanation**: The function divides the `ipv4_address` string into an array of individual numeric octets using the specified `.` delimiter.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS | IP\_OCTETS |
| --------- | ------------- | --------------------------- |
| 101 | 192.168.1.10 | \["192", "168", "1", "10"] |
| 102 | 10.0.0.5 | \["10", "0", "0", "5"] |
| 105 | 192.168.10.20 | \["192", "168", "10", "20"] |

### Example 2: Split without a specified delimiter

**Goal**: Split a log message into individual words using the default delimiter (space).

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102)
| alter log_words = split(raw_log_data)
| fields event_id, raw_log_data, log_words 
| limit 2
```

**Explanation**: By omitting the optional delimiter argument, the function automatically uses a space to break the `raw_log_data` string into an array of words.

**Output**:

| EVENT\_ID | RAW\_LOG\_DATA | LOG\_WORDS |
| --------- | ----------------------------------------------- | ------------------------------------------------------------------- |
| 101 | User Alice logged in from 192.168.1.10 | \["User", "Alice", "logged", "in", "from", "192.168.1.10"] |
| 102 | Process cmd.exe attempted to access /etc/passwd | \["Process", "cmd.exe", "attempted", "to", "access", "/etc/passwd"] |

### Example 3: Split with an empty string as delimiter

**Goal**: Explicitly use an empty string as the delimiter, which defaults to splitting by space.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 101
| alter log_parts = split(raw_log_data, "")
| fields event_id, raw_log_data, log_parts 
| limit 1
```

**Explanation**: Providing an empty string `""` for the delimiter results in the same behavior as omitting the delimiter; the string is split by spaces.

**Output**:

| EVENT\_ID | RAW\_LOG\_DATA | LOG\_PARTS |
| --------- | -------------------------------------- | ---------------------------------------------------------- |
| 101 | User Alice logged in from 192.168.1.10 | \["User", "Alice", "logged", "in", "from", "192.168.1.10"] |

### Example 4: Split on a delimiter not present in the string

**Goal**: Attempt to split a string using a delimiter that does not exist within that string.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 101
| alter no_split_example = split(event_description, "|")
| fields event_id, event_description, no_split_example 
| limit 1
```

**Explanation**: The function returns an array containing the original string as its single element because the pipe (`|`) character is not present in the `event_description`.

**Output**:

| EVENT\_ID | EVENT\_DESCRIPTION | NO\_SPLIT\_EXAMPLE |
| --------- | --------------------- | -------------------------- |
| 101 | User login successful | \["User login successful"] |

### Example 5: Split on a field containing NULL values

**Goal**: Handle input fields that contain NULL values.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id = 105
| alter split_null_domain = split(dst_domain, ".")
| fields event_id, dst_domain, split_null_domain 
| limit 1
```

**Explanation**: When the input string field (for example, `dst_domain` for event ID 105) is NULL, the function returns an empty array.

**Output**:

| EVENT\_ID | DST\_DOMAIN | SPLIT\_NULL\_DOMAIN |
| --------- | ----------- | ------------------- |
| 105 | NULL | \[] |

### Example 6: Combining split with arrayindex

**Goal**: Split a string and immediately extract a specific element from the resulting array.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw
| filter event_id in (101, 102)
| alter ip_parts_array = split(ipv4_address, ".")
| alter first_octet_string = arrayindex(ip_parts_array, 0)
| fields event_id, ipv4_address, ip_parts_array, first_octet_string 
| limit 2
```

**Explanation**: The query first uses `split()` to tokenize the `ipv4_address`. Subsequently, `arrayindex(..., 0)` extracts the first element (the first octet) as a string.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS | IP\_PARTS\_ARRAY | FIRST\_OCTET\_STRING |
| --------- | ------------- | -------------------------- | -------------------- |
| 101 | 192.168.1.10 | \["192", "168", "1", "10"] | 192 |
| 102 | 10.0.0.5 | \["10", "0", "0", "5"] | 10 |

## Related articles

* **Stages**: [`alter`](../stages/alter), [`filter`](../stages/filter)
* **Functions**: [`arrayindex`](arrayindex), [`to_string`](to_string), [`arraystring`](arraystring)
* **Datasets**: [`xdr_data`](https://www.google.com/search?q=%5Bhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction%5D\(https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction\))