[FEATURE] Add string split function to PPL

[A-Gray-Cat]

Is your feature request related to a problem?
Analysts would want to split a string using a delimiter. For example, when analyzing DNS logs, analysts would split the hostname using the "." delimiter.

What solution would you like?
A function that's similar to the split_part(str, delimiter, partNum) function in Spark SQL:

• Splits str by delimiter and return requested part of the split (1-based). If any input is null, returns null. if partNum is out of range of split parts, returns empty string. If partNum is 0, throws an error. If partNum is negative, the parts are counted backward from the end of the string. If the delimiter is an empty string, the str is not split.

What alternatives have you considered?
A clear and concise description of any alternative solutions or features you've considered.

Do you have any additional context?
Add any other context or screenshots about the feature request here.

[YANG-DB]

@A-Gray-Cat
this is possible today using the parse command as shown here

source=accounts | parse address '(?<streetNumber>\d+) (?<street>.+)' | sort num(streetNumber) | fields streetNumber, street

[A-Gray-Cat]

Yeah. I'm aware of that function. Regex parsing can do what split can do, but for many folks, regex is just difficult to get right in the first run.

Having a dedicated string splitting function can make this experience much easier.

I agree with you that, since the use case is supported by parse, we can prioritize other tasks over this one.