arraycreate - Learn more about the Cortex Query Language arraycreate() function that returns an array based on the given parameters defined for the array elements. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

arraycreate ("<array element1>", "<array element2>",...)

The arraycreate() function returns an array based on the given parameters defined for the array elements.

Returns a final array to a field called x that is comprised of the elements [1,2].

dataset = xdr_data
| alter x = arraycreate("1", "2")
| fields x