Important

This function must be enabled using the feature flag ArrayFunctions. See Enabling/Disabling Features.

Did you find this function useful? We are soliciting feedback on this function. Please use this form to provide input about how you've used the function and whether it met your needs.

Determines the set intersection of array values over input events. Use this to compute the values that occur in all events supplied to this function.

  • The output order of the values is not defined.

  • Empty arrays are ignored.

  • If no arrays are found, the output is empty.

ParameterTypeRequiredDefaultDescription
arraystringtrue The prefix of the array in Humio, for example for events with fields 'incidents[0], incidents[1], ...' this would be 'incidents'. [a]
asstringfalse The name of the output array

[a] When you provide only one parameter, the implied parameter is array

Examples

Given two events with the fields:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[0]=bar@example.com

Return the addresses present in all events:

logscale
array:intersection(mailto, as=unique_mails)

Expected result:

logscale
unique_mails[0]=bar@example.com