array_split

You can use array_split to:

Divide large datasets into manageable chunks for processing.
Create segments for detailed analysis or visualization.
Handle nested data structures for targeted processing.

Usage#

Syntax#

array_split(array, index)

Parameters#

Parameter	Description	Type
`array`	The array to split.	Dynamic
`index`	An integer or dynamic array of integers. These zero-based split indices indicate the location at which to split the array.	Integer or Dynamic

Returns#

Returns a dynamic array containing N+1 arrays where N is the number of input indices. The original array is split at the input indices.

Use case examples#

Single split index#

Split large event arrays into manageable chunks for analysis.

['otel-demo-traces']
| where array_length(events) == 3
| extend split_events = array_split(events, 2)

Run in Playground

Output

events

[
  {
    "timestamp": 1734033733465219300,
    "name": "Enqueued"
  },
  {
    "name": "Sent",
    "timestamp": 1734033733465228500
  },
  {
    "timestamp": 1734033733465455900,
    "name": "ResponseReceived"
  }
]

split_events

[
  [
    {
      "timestamp": 1734033733465219300,
      "name": "Enqueued"
    },
    {
      "name": "Sent",
      "timestamp": 1734033733465228500
    }
  ],
  [
    {
      "timestamp": 1734033733465455900,
      "name": "ResponseReceived"
    }
  ]
]

This query splits the events array at index 2 into two subarrays for further processing.

Multiple split indeces#

Divide traces into fixed-size segments for better debugging.

Query

['otel-demo-traces']
| where array_length(events) == 3
| extend split_events = array_split(events, dynamic([1,2]))

Run in Playground

Output

events

[
  {
    "attributes": null,
    "name": "Enqueued",
    "timestamp": 1734034755085206000
  },
  {
    "name": "Sent",
    "timestamp": 1734034755085215500,
    "attributes": null
  },
  {
    "attributes": null,
    "name": "ResponseReceived",
    "timestamp": 1734034755085424000
  }
]

split_events

[
  [
    {
      "timestamp": 1734034755085206000,
      "attributes": null,
      "name": "Enqueued"
    }
  ],
  [
    {
      "timestamp": 1734034755085215500,
      "attributes": null,
      "name": "Sent"
    }
  ],
  [
    {
      "attributes": null,
      "name": "ResponseReceived",
      "timestamp": 1734034755085424000
    }
  ]
]

This query splits the events array into three subarrays based on the indices [1,2].

array_index_of: Finds the index of an element in an array.
array_rotate_right: Rotates array elements to the right by a specified number of positions.
array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.

Other query languages#

Splunk SPL users

In Splunk SPL, array manipulation is achieved through functions like mvzip and mvfilter, but there is no direct equivalent to array_split. APL provides a more explicit approach for splitting arrays.

Splunk example

| eval split_array = mvzip(array_field, "2")

APL equivalent

['otel-demo-traces']
| extend split_array = array_split(events, 2)

ANSI SQL users

ANSI SQL doesn’t have built-in functions for directly splitting arrays. APL provides this capability natively, making it easier to handle array operations within queries.

SQL example

-- SQL typically requires custom functions or JSON manipulation.
SELECT * FROM dataset WHERE JSON_ARRAY_LENGTH(array_field) > 0;