substring

This page explains how to use the substring function in APL.

The substring function extracts a substring from a source string starting at a specified position. Use this function to parse fixed-format logs, extract specific segments from structured strings, or truncate text fields.

Usage

Syntax

substring(source, startingIndex, length)

Parameters

Name	Type	Required	Description
source	string	Yes	The source string to extract from.
startingIndex	int	Yes	The zero-based starting position.
length	int	No	The number of characters to extract. If omitted, extracts to the end.

Returns

Returns the extracted substring. Returns empty string if startingIndex is beyond the string length.

Use case examples

Extract specific segments from fixed-format URIs or identifiers.

Query

['sample-http-logs']
| extend api_version = substring(uri, 1, 4)
| where api_version == 'api/'
| extend endpoint = substring(uri, 5, 20)
| summarize request_count = count() by endpoint, method
| sort by request_count desc
| limit 10

Run in Playground

Output

endpoint	method	request_count
users	GET	2341
orders	POST	1987
products	GET	1654

This query extracts API endpoints from URIs by taking specific character ranges, enabling analysis of API usage patterns.

Extract prefixes from trace IDs for partitioning or routing analysis.

Query

['otel-demo-traces']
| extend trace_prefix = substring(trace_id, 0, 4)
| extend trace_suffix = substring(trace_id, strlen(trace_id) - 4, 4)
| summarize span_count = count() by trace_prefix
| sort by span_count desc
| limit 10

Run in Playground

Output

trace_prefix	span_count
abcd	1234
ef12	1123
89ab	987

This query extracts trace ID prefixes to analyze trace distribution patterns, which can help with load balancing and trace routing strategies.

Extract and analyze specific segments of suspicious URIs or user identifiers.

Query

['sample-http-logs']
| extend uri_start = substring(uri, 0, 10)
| extend uri_has_exploit = indexof(uri_start, '..') >= 0 or indexof(uri_start, '&lt;script') >= 0
| where uri_has_exploit
| project _time, uri, uri_start, uri_has_exploit, id, status, ['geo.country']
| limit 10

Run in Playground

Output

_time	uri	uri_start	uri_has_exploit	id	status	geo.country
2024-11-06T10:00:00Z	`../../etc/passwd`	`../../etc/`	true	user123	403	Unknown
2024-11-06T10:01:00Z	`<script>alert(1)`	`<script>al`	true	user456	403	Russia

This query extracts the beginning of URIs to quickly identify common attack patterns like path traversal or XSS attempts.

extract: Extracts substrings using regex. Use this when you need pattern-based extraction rather than position-based.
split: Splits strings by delimiters. Use this when you need to tokenize rather than extract by position.
strlen: Returns string length. Use this to calculate positions relative to string length.
indexof: Finds substring positions. Use this to find dynamic starting positions for substring extraction.

substring

Usage

Syntax

Parameters

Returns

Use case examples

List of related functions

Other query languages