substr()
Returns the substring of the source string starting at the specified position. If this receives a value other than the string, it evaluates the value after converting it to a string.
Syntax
substr(STR_EXPR, START_INDEX[, END_INDEX])
Required Parameter
STR_EXPR
- Source string expression. If the expression is
null
, the function returnsnull
. START_INDEX
- Starting index of the substring. The index starts at
0
. If the index is negative, the position is calculated from the end of the string. The function returnsnull
if the start position is greater than the length of the string.
Optional Parameter
END_INDEX
- Last index of the substring. The character at the last index is not included in the returned substring. Omitting this index means that the last index of the substring is the same as the last index of the source string. If the index is negative, the position is calculated from the end of the string. If the end position is greater than the length of the string, it returns from the start position to the end of the string.
Usage
json "{}" | eval partion_str=substr("0123456789", 2)
=> "23456789"
json "{}" | eval partion_str=substr("0123456789", -2)
=> "89"
json "{}" | eval partion_str=substr("0123456789", 0, 3)
=> "012"
json "{}" | eval partion_str=substr("0123456789", 4, 12)
=> "456789"
json "{}" | eval partion_str=substr("0123456789", 5, 5)
=> ""
json "{}" | eval partion_str=substr("0123456789", 10, 11)
=> null
json "{}" | eval partion_str=substr("0123456789", -1, 11)
=> "9"
json "{}" | eval partion_str=substr(null, 0, 3)
=> null