Skip to content

regexpSplitParts - Split and capture a token in one command

We often split string values in order to capture some consistent parts. For example, we split [email protected] on @ to capture the domain, coralogix.com. regexpSplitParts does two things in one. The first is it splits a string on some delimiter regular expression. The second is it returns the Nth token.

NOTE: index counts from 1, not from 0.

Syntax

regexpSplitParts(string: string, delimiter: regexp, index: number): string

Arguments

NameTypeRequiredDescription
stringstringtrueThe string to split
delimiterregexptrueThe regex delimiter on which to split the string
indexnumbertrueThe index of the desired split strings.

Example - Capturing values from inconsistent data

Consider the following document:

{
    "values": "val=4 val2=8  val3=9   val4=10"
}

Extracting a key-value pair from this document will be challenging, because they are all separated by a varying number of spaces. regexpSplitParts can handle this. I can use regexpSplitParts to split the values based on 1 or more ' ' characters, and then grab the value that I want.

create val from values.regexpSplitParts(/\s+/, 3)

This results in the following document:

{
    "email": "[email protected]",
    "val": "val3=9"
}

Try it yourself

Open up your log explore screen and run the following command:

create values from 'val=4 val2=8  val3=9   val4=10'
| create val from values.regexpSplitParts(/\s+/, 3)