Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Split

Description

The Split processor splits a string into a list of strings using a specified delimiter.

Use

The Split processor divides a string into a list of strings using a delimiter. Common delimiters include commas (,) and newlines (\\n).

Supported Types

MetricsLogsTraces

Configuration

FieldDescription
Telemetry TypesSpecifies which types of telemetry the processor should be applied to.
DelimiterThe character or string used to split the field.
ConditionDefines when the processor should be applied. If not specified, the processor will attempt to process all telemetry.
Split FromThe source field to split.
Split ToThe destination field that will store the split values.

Example Configuration(s)

Splitting a log body by commas

This example demonstrates splitting a log body by commas and storing the resulting values back in the log body. The processor only applies when the body field equals "a,b,c", as specified in the Condition field.

Web Interface

observIQ docs - Split - by commas

Setting an attribute based on a split log record body

This example shows how to split the body field by commas and store the resulting values in a new attribute called splitField.

Web Interface

observIQ docs - Split - split body