array_slice()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Extracts a slice of a dynamic array.

Syntax

array_slice(array, start, end)

Name	Type	Required	Description
array	`dynamic`	✔️	The array from which to extract the slice.
start	`int`	✔️	The start index of the slice (inclusive). Negative values are converted to `array_length`+`start`.
end	`int`	✔️	The last index of the slice. (inclusive). Negative values are converted to `array_length`+`end`.

Note

Out of bounds indices are ignored.

Returns a dynamic array of the values in the range [start..end] from array.

The following examples return a slice of the array.

print arr=dynamic([1,2,3]) 
| extend sliced=array_slice(arr, 1, 2)

Output

arr	sliced
[1,2,3]	[2,3]

print arr=dynamic([1,2,3,4,5]) 
| extend sliced=array_slice(arr, 2, -1)

Output

arr	sliced
[1,2,3,4,5]	[3,4,5]

print arr=dynamic([1,2,3,4,5]) 
| extend sliced=array_slice(arr, -3, -2)

Output

arr	sliced
[1,2,3,4,5]	[3,4]