Important

This function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Did you find this function useful? We are soliciting feedback on this function. Please use this form to provide input about how you've used the function and whether it met your needs.

Determines the set intersection of array values over input events. Use this to compute the values that occur in all events supplied to this function.

  • The output order of the values is not defined.

  • Empty arrays are ignored.

  • If no arrays are found, the output is empty.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired  The prefix of the array in LogScale, for example for events with fields incidents[0], incidents[1], ... this would be incidents.
asstringoptional[b]_intersection The name of the output array

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Given two events with the fields:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[0]=bar@example.com

Return the addresses present in all events:

logscale
array:intersection(mailto, as=unique_mails)

Expected result:

logscale
unique_mails[0]=bar@example.com