arrayindex

Learn more about the Cortex Query Language arrayindex() function that returns the array element contained at the specified index.

Syntax

arrayindex(<array>, <index>)

Description

The arrayindex() function returns the value contained in the specified array position. Arrays are 0-based, and negative indexing is supported.

Examples

Use the split function to split IP addresses into an array of octets. Return the 3rd octet contained in the IP address.

dataset = xdr_data 
| fields action_local_ip  as alii 
| alter ip_third_octet = arrayindex(split(alii, "."), 2) 
| filter alii != null and alii != "0.0.0.0" 
| limit 10