substr()

Returns the substring of the source string starting at the specified position. If this receives a value other than the string, it evaluates the value after converting it to a string.

Syntax

substr(STR_EXPR, START_INDEX[, END_INDEX])
Required Parameters
STR_EXPR
Source string expression. If the expression is null, the function returns null.
START_INDEX
Starting index of the substring. The index starts at 0. If the index is negative, the position is calculated from the end of the string. The function returns null if the start position is greater than the length of the string.
Optional Parameters
END_INDEX
Last index of the substring. The character at the last index is not included in the returned substring. Omitting this index means that the last index of the substring is the same as the last index of the source string. If the index is negative, the position is calculated from the end of the string. If the end position is greater than the length of the string, it returns from the start position to the end of the string.

Usage

json "{}" | eval partion_str=substr("0123456789", 2)
  => "23456789"

json "{}" | eval partion_str=substr("0123456789", -2)
  => "89"

json "{}" | eval partion_str=substr("0123456789", 0, 3)
  => "012"

json "{}" | eval partion_str=substr("0123456789", 4, 12)
  => "456789"

json "{}" | eval partion_str=substr("0123456789", 5, 5)
  => ""

json "{}" | eval partion_str=substr("0123456789", 10, 11)
  => null

json "{}" | eval partion_str=substr("0123456789", -1, 11)
  => "9"

json "{}" | eval partion_str=substr(null, 0, 3)
=> null