HI All, Adventures continue looking into handeling version numbers from the apps table as we're wishing to track a versioning standard that includes letters a-z in their released versions; though this query result threw me;

osquery> SELECT REGEX_SPLIT('3b','[a-z]',1);
+-----------------------------+
| REGEX_SPLIT('3b','[a-z]',1) |
+-----------------------------+
|                             |
+-----------------------------+
osquery> SELECT REGEX_SPLIT('3b','[a-z]',0);
+-----------------------------+
| REGEX_SPLIT('3b','[a-z]',0) |
+-----------------------------+
| 3                           |
+-----------------------------+
osquery> SELECT REGEX_SPLIT('3b','[0-9]',0);
+-----------------------------+
| REGEX_SPLIT('3b','[0-9]',0) |
+-----------------------------+
|                             |
+-----------------------------+
osquery> SELECT REGEX_SPLIT('3b','[0-9]',1);
+-----------------------------+
| REGEX_SPLIT('3b','[0-9]',1) |
+-----------------------------+
| b                           |
+-----------------------------+

Am I missing something w.r.t how the

REGEX_SPLIT

function works, as this appears to not follow the regex pattern being passed in the examples above. 1.

3b

is split upon regex pattern

[a-z]

index 0 is the integer 3, whilst index 1 matched nothing 🤔 2.

3b

is split upon regex patter

[0-9]

index 0 is nothing, whilst index 1 returns the character b 🤔 These appear to be working in reverse to how REGEX_SPLIT should be working ?