$substr (start-char, num-chars) function


This function returns a string from the target message starting at start-char position and continuing for num-chars character count. The resulting string can contain any number of characters and characters of any type (including spaces). You can use the function to parse session identifiers or other arbitrary character data based on a start character in the message.

The following examples show target strings, parse expressions, and return values:

Target String

Parse Expression

Return Value

AA BB CC DD EE

$substr (5, 6)

B CC D

123456789012345

$substr (3, 2)

34 

123456789

$substr (3, 99)

3456789

Explanation: The number of characters exceeds the length of the string, and all characters are returned.

ABCDE

$substr (10, 1)

No match

Explanation: The start char first argument is longer than the target string.

Related topic


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 6.2