arrayexpand

Learn more about the Cortex Query Language arrayexpand stage.

Syntax

arrayexpand <array_field> [limit <limit number>]

Description

The arrayexpand stage expands the values of a mulit-value array field into separate events and creates one record in the result set for each item in the array, up to a <limit number> of records.

Example

Suppose you have a dataset with a single row like this:

uid	username	array_values
123456	ajohnson	[1,2,3,4,5,6,7,8,9,0]

Then if you run an arrayexpand stage using the array_values field, with a limit of 3, the result set includes the following records:

dataset=my_dataset 
| arrayexpand array_values limit 3

uid	username	array_values
123456	ajohnson	2
123456	ajohnson	1
123456	ajohnson	3

Note

The result records created by arrayexpand are in no particular order. However, you can use the sort stage to sort the results:

dataset=my_dataset 
| arrayexpand array_values 
| sort asc array_values