splitParts - Split and capture a token in one command

We often split string values in order to capture some consistent parts. For example, we split [email protected] on @ to capture the domain, coralogix.com. splitParts does two things in one. The first is it splits a string on some delimiter value. The second is it returns the Nth token.

NOTE: index counts from 1, not from 0.

Syntax

splitParts(string: string, delimiter: string, index: number): string

Arguments

Name	Type	Required	Description
string	string	true	The string to split
delimiter	string	true	The deliter on which to split the string
index	number	true	The index of the desired split strings.

Example - Capturing domain from email

Consider the following document:

{
    "email": "[email protected]"
}

If I want to extract the domain from this email, I can do it in one line, using the splitParts function.

create domain from email.splitParts('@', 2)

This results in the following document:

{
    "email": "[email protected]",
    "domain": "coralogix.com"
}

Try it yourself

Open up your log explore screen and run the following command:

create email from '[email protected]'
| create domain from email.splitParts('@', 2)

rtrim

Next startsWith