arrayconcat

Cortex XDR XQL arrayconcat() function returns an array containing unique values found in the original array.

Synopsis

arrayconcat (<array1>,<array2>[,<array3>...])

The

arrayconcat()

function accepts two or more arrays, and it joins them into a single array. For example, given three arrays:

first_array : [1,2,3]
second_array : [44,55]
third_array : [4,5,6]

this:

alter all_arrays = arrayconcat(first_array, second_array, third_array)

results in an

all_arrays

field containing:

[1,2,3,44,55,4,5,6]