substring

This page explains how to use the substring function in APL.

The substring function extracts a substring from a source string starting at a specified position. Use this function to parse fixed-format logs, extract specific segments from structured strings, or truncate text fields.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use the substr function. APL’s substring provides similar functionality with zero-based indexing.

Splunk example

| eval extracted=substr(field, 5, 10)

Note: Splunk uses 1-based indexing while APL uses 0-based indexing.

ANSI SQL users

In ANSI SQL, you use SUBSTRING with similar syntax. APL’s substring provides the same functionality.

SQL example

SELECT SUBSTRING(field, 5, 10) AS extracted FROM logs;

Usage

Syntax

substring(source, startingIndex, length)

Parameters

Name	Type	Required	Description
source	string	Yes	The source string to extract from.
startingIndex	int	Yes	The zero-based starting position.
length	int	No	The number of characters to extract. If omitted, extracts to the end.

Returns

Returns the extracted substring. Returns empty string if startingIndex is beyond the string length.

Use case examples

Log analysis

Extract specific segments from fixed-format URIs or identifiers.

Query

['sample-http-logs']
| extend api_version = substring(uri, 1, 4)
| where api_version == 'api/'
| extend endpoint = substring(uri, 5, 20)
| summarize request_count = count() by endpoint, method
| sort by request_count desc
| limit 10

Run in Playground

Output

endpoint	method	request_count
users	GET	2341
orders	POST	1987
products	GET	1654

This query extracts API endpoints from URIs by taking specific character ranges, enabling analysis of API usage patterns.

List of related functions

• extract: Extracts substrings using regex. Use this when you need pattern-based extraction rather than position-based.
• split: Splits strings by delimiters. Use this when you need to tokenize rather than extract by position.
• strlen: Returns string length. Use this to calculate positions relative to string length.
• indexof: Finds substring positions. Use this to find dynamic starting positions for substring extraction.