regexpSplitParts - Split and capture a token in one command

We often split string values in order to capture some consistent parts. For example, we split [email protected] on @ to capture the domain, coralogix.com. regexpSplitParts does two things in one. The first is it splits a string on some delimiter regular expression. The second is it returns the Nth token.

NOTE: index counts from 1, not from 0.

Syntax

regexpSplitParts(string: string, delimiter: regexp, index: number): string

Arguments

Name	Type	Required	Description
string	string	true	The string to split
delimiter	regexp	true	The regex delimiter on which to split the string
index	number	true	The index of the desired split strings.

Example - Capturing values from inconsistent data

Consider the following document:

{
    "values": "val=4 val2=8  val3=9   val4=10"
}

Extracting a key-value pair from this document will be challenging, because they are all separated by a varying number of spaces. regexpSplitParts can handle this. I can use regexpSplitParts to split the values based on 1 or more ' ' characters, and then grab the value that I want.

create val from values.regexpSplitParts(/\s+/, 3)

This results in the following document:

{
    "email": "[email protected]",
    "val": "val3=9"
}

Try it yourself

Open up your log explore screen and run the following command:

create values from 'val=4 val2=8  val3=9   val4=10'
| create val from values.regexpSplitParts(/\s+/, 3)

padRight

Next rtrim