Kusto query language split @ character and take last item

Question

If I have a string for example: "this.is.a.string.and.I.need.the.last.part" I am trying to get the last part of the string after the last ".", which in this case is "part" How to I achieve this? One way I tried was to split the string on ".", I get a array back, but then I don't know how to retrieve the last item in the array.

| extend ToSplitstring = split("this.is.a.string.and.I.need.the.last.part", ".")

gives me:

["this", "is","a","string","and","I","need","the","last", "part"]

and a second try I have tried this:

| extend ToSubstring = substring(myString, lastindexof(myString, ".")+1)

but Kusto do not have a function of lastindexof.

Anyone with tips?

score 22 · Accepted Answer · answered Sep 16 '20 at 14:30

22

you can access the last member of the array using a negative index -1.

e.g. this:

print split("this.is.a.string.and.I.need.the.last.part", ".")[-1]

returns a single table, with a single column and a single record, with the value part

answered Sep 16 '20 at 14:30

Yoni L.

22,627
2
29
48

That easy, seriously. Now I feel bad. Thank you – user1702369 Sep 17 '20 at 09:09

score 0 · Answer 2 · answered Sep 16 '20 at 09:49

You can try the code below, and feel free to change it to meet your need:

let lastIndexof = (input:string, lookup: string) {
    indexof(input, lookup, 0, -1, countof(input,lookup))
};
your_table_name 
| extend ToSubstring = substring("this.is.a.string.and.I.need.the.last.part", lastIndexof("this.is.a.string.and.I.need.the.last.part", ".")+1)

Kusto query language split @ character and take last item

2 Answers2