arrayconcat - Reference Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR XQL Language Reference

Product
Cortex XDR
Creation date
2024-07-16
Last date published
2024-11-25
Category
Reference Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation/Cortex-XDR-XQL
Abstract

Learn more about the Cortex Query Language arrayconcat() function that returns an array containing unique values found in the original array.

Syntax

arrayconcat (<array1>,<array2>[,<array3>...])

Description

The arrayconcat() function accepts two or more arrays, and it joins them into a single array.

Example

Given three arrays:

first_array : [1,2,3]
second_array : [44,55]
third_array : [4,5,6] 

Using this query:

alter all_arrays = arrayconcat(first_array, second_array, third_array)

Results in an all_arrays field containing:

[1,2,3,44,55,4,5,6]