indexof()

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Reports the zero-based index of the first occurrence of a specified string within the input string.

For more information, see indexof_regex().

Syntax

indexof(string,match[,start[,length[,occurrence]]])

Learn more about syntax conventions.

Parameters

Name Type Required Description
string string ✔️ The source string to search.
match string ✔️ The string for which to search.
start int The search start position. A negative value will offset the starting search position from the end of the string by this many steps: abs(start).
length int The number of character positions to examine. A value of -1 means unlimited length.
occurrence int The number of the occurrence. The default is 1.

Note

If string or match isn't of type string, the function forcibly casts their value to string.

Returns

The zero-based index position of match.

  • Returns -1 if match isn't found in string.
  • Returns null if:
    • start is less than 0.
    • occurrence is less than 0.
    • length is less than -1.

Examples

Run the query

print
 idx1 = indexof("abcdefg","cde")    // lookup found in input string
 , idx2 = indexof("abcdefg","cde",1,4) // lookup found in researched range 
 , idx3 = indexof("abcdefg","cde",1,2) // search starts from index 1, but stops after 2 chars, so full lookup can't be found
 , idx4 = indexof("abcdefg","cde",3,4) // search starts after occurrence of lookup
 , idx5 = indexof("abcdefg","cde",-5)  // negative start index
 , idx6 = indexof(1234567,5,1,4)       // two first parameters were forcibly casted to strings "12345" and "5"
 , idx7 = indexof("abcdefg","cde",2,-1)  // lookup found in input string
 , idx8 = indexof("abcdefgabcdefg", "cde", 1, 10, 2)   // lookup found in input range
 , idx9 = indexof("abcdefgabcdefg", "cde", 1, -1, 3)   // the third occurrence of lookup is not in researched range

Output

idx1 idx2 idx3 idx4 idx5 idx6 idx7 idx8 idx9
2 2 -1 -1 2 4 2 9 -1