Access component parts of probe name

[ajor]

Is your feature request related to a problem? Please describe.

When aggregating data from tracepoint probes, it is only currently possible to distinguish the data from each tracepoint by using the probe builtin:

tracepoint:syscalls:sys_enter_*
{
  @syscalls[probe] = count();
}

@syscalls[tracepoint:syscalls:sys_enter_close]: 35883
@syscalls[tracepoint:syscalls:sys_enter_openat]: 37641
@syscalls[tracepoint:syscalls:sys_enter_read]: 49833
@syscalls[tracepoint:syscalls:sys_enter_newfstatat]: 78194

It would be nice to have a way to access only part of the attach point's definition, so that we could generate output like this:

@syscalls[sys_enter_close]: 35883
@syscalls[sys_enter_openat]: 37641
@syscalls[sys_enter_read]: 49833
@syscalls[sys_enter_newfstatat]: 78194

Describe the solution you'd like

Provide a way to access component parts of a probe's definition. probe will still return the full probe name, but individual pieces could be accessed as if it was an array:

probe;    // tracepoint:syscalls:sys_enter_read
probe[0]; // tracepoint
probe[1]; // syscalls
probe[2]; // sys_enter_read

Or tuple style:

probe.0; // tracepoint
probe.1; // syscalls
probe.2; // sys_enter_read

Describe alternative solutions or features you've considered

func is an alternative for some use-cases (e.g. kprobes), but it doesn't work for all probe types (e.g. tracepoints) and its semantics are still not fully defined when tracing inlined functions.

Problems

• I suppose this could only work if all attachment points of a probe were of the same type, i.e. all tracepoints or all USDTs. A mixture would lead to strange behaviour.
• What do we do about probes types which take a variable number of parameters? e.g. kfunc:foo vs kfunc:module:foo