split()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

The split() function takes a string and splits it into substrings based on a specified delimiter, returning the substrings in an array. Optionally, you can retrieve a specific substring by specifying its index.

Syntax

split(source, delimiter [, requestedIndex])

Learn more about syntax conventions.

Parameters

Name Type Required Description
source string ✔️ The source string that is split according to the given delimiter.
delimiter string ✔️ The delimiter that will be used in order to split the source string.
requestedIndex int A zero-based index. If provided, the returned string array contains the requested substring at the index if it exists.

Returns

An array of substrings obtained by separating the source string by the specified delimiter, or a single substring at the specified requestedIndex.

Note

To further manipulate the resulting array, see dynamic object accessors.

Examples

Run the query

print
    split("aa_bb", "_"),           // ["aa","bb"]
    split("aaa_bbb_ccc", "_", 1),  // ["bbb"]
    split("", "_"),                // [""]
    split("a__b", "_"),            // ["a","","b"]
    split("aabbcc", "bb")          // ["aa","cc"]
print_0 print_1 print_2 print_3 print4
["aa","bb"] ["bbb"] [""] ["a","","b"] ["aa","cc"]