# SUBSTRING

The `SUBSTRING` function extracts a portion of a string based on a specified start position and an optional length.

## Syntax

`SUBSTRING(string, start, length)`

### Parameters

#### `string`

The string expression to extract the substring from. If `null`, the function returns `null`.

#### `start`

The starting position for the substring. A negative value is interpreted as being relative to the end of the string.

#### `length` (Optional)

The length of the substring to extract, starting from the `start` position. If omitted, the function returns all characters from the `start` position to the end of the string.

## Examples

Extract the first three characters of every last name

```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
```

This example extracts the first three characters from the `last_name` column.

Extract the last three characters of every last name

```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
```

This example extracts the last three characters from the `last_name` column by using a negative start position.

Extract all characters except for the first

```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)
```

This example extracts all characters from the `last_name` column starting from the second character, as the `length` parameter is omitted.

## Limitations

No specific limitations are mentioned for the `SUBSTRING` function.
