Skip to main content

Split action

Available for event and incident workflows

This action splits one field into substrings and copies them to other fields in the same object. This action is useful for fields that delineate their values using a consistent character string, such as : or ::. For fields with substrings that can be extracted using a regex, use the Extract Substring action.

This action takes the following inputs:

  • Input Field

    The object field to split.

  • Split String

    The string pattern to split on, such as / or :: or ,

  • Output Fields

    The fields to copy the substrings to, in order.

Limitations using the service field: event workflow example

Note

The services field is also invalid input for this action for incident workflows.

Values for the service field do not work the same way with the Split action as in the first example. You cannot split up the list of services.

If you configure the workflow like this:

SplitActionWorkflowWithService.png

And you test:

TestSplitWorkflowActionWithService.png

The output result is the same as the input array:

SplitActionWorkflowServiceNotWorking.png

In use, the tags fields retain their original values and are not updated with the individual services.

Event example

Split works the same way for both events and incidents.

In this example, suppose your monitoring service generates events with a "database" tag like this:

{
    ...
    "tags": {
        "database": "myNamespace_myCluster_myDBname"
    }
}

You want to split the namespace, cluster, and database name into separate tags. You configure your Split action like this:

  • Input field = tags.database

  • Split string = _

  • Output fields = tags.namespace, tags.cluster, tags.database

Here is an example event that was processed by this workflow:

Event before

Event after

{
  ...
  "tags": {
    "database": "myNamespace_myCluster_myDBname"
  }
} 

{
  ...
  "tags": {
    "namespace": "myNamespace",
    "cluster": "myCluster",
    "database": "myDatabase"
  }
}
In this section: