array_length

Learn more about the Cortex Query Language array_length() function that returns the length of an array.

Syntax

array_length (<array>)

Description

The array_length() function returns the number of elements in an array. When array_length receives an empty field the result returned is NULL.

Example

dataset = xdr_data 
| fields action_local_ip as alii 
| alter ip_len = array_length(split(alii, ".")) 
| filter alii != null and alii != "0.0.0.0" 
| limit 1