# SUBSTRING

The SUBSTRING function returns a substring from a string, based on a specified start position and an optional length.

## Syntax

`SUBSTRING(string, start, length)`

### Parameters

#### string

The string expression to extract the substring from. If the value is `null`, the function returns `null`.

#### start

The position in the string where the substring begins. Negative values are interpreted as positions relative to the end of the string.

#### length

(Optional) The number of characters to include in the substring, starting from the start position. If omitted, all characters after the start position are returned.

## Examples

Extracts the first three characters from each employee's last name.
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
```

Extracts the last three characters from each employee's last name by using a negative start position.
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
```

Extracts all characters from each employee's last name except for the first character by omitting the length parameter.
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)
```