array_split

This page explains how to use the array_split function in APL.

The array_split function in APL splits an array into smaller subarrays based on specified split indices and packs the generated subarrays into a dynamic array. This function is useful when you want to partition data for analysis, batch processing, or distributing workloads across smaller units.

You can use array_split to:

• Divide large datasets into manageable chunks for processing.
• Create segments for detailed analysis or visualization.
• Handle nested data structures for targeted processing.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, array manipulation is achieved through functions like mvzip and mvfilter, but there is no direct equivalent to array_split. APL provides a more explicit approach for splitting arrays.

Splunk example

| eval split_array = mvzip(array_field, "2")

ANSI SQL users

ANSI SQL does not have built-in functions for directly splitting arrays. APL provides this capability natively, making it easier to handle array operations within queries.

SQL example

-- SQL typically requires custom functions or JSON manipulation.
SELECT * FROM dataset WHERE JSON_ARRAY_LENGTH(array_field) > 0;

Usage

Syntax

array_split(array, index)

Parameters

Parameter	Description	Type
array	The array to split.	Dynamic
index	An integer or dynamic array of integers. These zero-based split indices indicate the location at which to split the array.	Integer or Dynamic

Returns

Returns a dynamic array containing N+1 arrays where N is the number of input indices. The original array is split at the input indices.

Use case examples

Single split index

Split large event arrays into manageable chunks for analysis.

['otel-demo-traces']
| where array_length(events) == 3
| extend split_events = array_split(events, 2)

Run in Playground

Output

events

[
  {
    "timestamp": 1734033733465219300,
    "name": "Enqueued"
  },
  {
    "name": "Sent",
    "timestamp": 1734033733465228500
  },
  {
    "timestamp": 1734033733465455900,
    "name": "ResponseReceived"
  }
]

split_events

[
  [
    {
      "timestamp": 1734033733465219300,
      "name": "Enqueued"
    },
    {
      "name": "Sent",
      "timestamp": 1734033733465228500
    }
  ],
  [
    {
      "timestamp": 1734033733465455900,
      "name": "ResponseReceived"
    }
  ]
]

This query splits the events array at index 2 into two subarrays for further processing.

Multiple split indeces

Divide traces into fixed-size segments for better debugging.

Query

['otel-demo-traces']
| where array_length(events) == 3
| extend split_events = array_split(events, dynamic([1,2]))

Run in Playground

Output

events

[
  {
    "attributes": null,
    "name": "Enqueued",
    "timestamp": 1734034755085206000
  },
  {
    "name": "Sent",
    "timestamp": 1734034755085215500,
    "attributes": null
  },
  {
    "attributes": null,
    "name": "ResponseReceived",
    "timestamp": 1734034755085424000
  }
]

split_events

[
  [
    {
      "timestamp": 1734034755085206000,
      "attributes": null,
      "name": "Enqueued"
    }
  ],
  [
    {
      "timestamp": 1734034755085215500,
      "attributes": null,
      "name": "Sent"
    }
  ],
  [
    {
      "attributes": null,
      "name": "ResponseReceived",
      "timestamp": 1734034755085424000
    }
  ]
]

This query splits the events array into three subarrays based on the indices [1,2].

List of related functions

• array_index_of: Finds the index of an element in an array.
• array_rotate_right: Rotates array elements to the right by a specified number of positions.
• array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.