$substr (start-char, num-chars) function


Return a string from the target message starting at start-char position and continuing for num-chars character count. The resulting string can contain any number of characters and characters of any type (including spaces). This function is particularly good at parsing session identifiers or other arbitrary character data based on a start character in the message.

Target String

Parse Expression

Return Value

AA BB CC DD EE

$substr(5, 6)

B CC D

123456789012345

$substr(3, 2)

34 

123456789

$substr(3, 99)

3456789

Warning

Note

The number of characters exceeds the length of the string, and all characters are returned.

ABCDE

$substr(10, 1)

No match. The start char first argument is longer than the target string.

Related topic


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 6.0