---
title: substr
description: |
  Extracts a substring from a string starting at a given position, with an optional length.
  Useful for simple value extraction without needing regular expressions.
url: https://coralogix.com/docs/dataprime/language-reference/functions-reference/string/substr/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-10-21'
---

# `substr`

## Description

Extracts a substring from a string starting at a given position, with an optional length. Useful for simple value extraction without needing regular expressions.

## Syntax

Like many functions in DataPrime, `substr` supports<!-- --> [two notations](https://coralogix.com/docs/dataprime/language-reference/functions-reference.md),<!-- --> **function** and **method**. These interchangeable forms allow flexibility in how you structure expressions.

* Function notation
* Method notation

```
substr(value: string, from: number, length?: number): string
```

```
(value: string).substr(from: number, length?: number): string
```

## Arguments

| Name     | Type     | Required  | Description                                                             |
| -------- | -------- | --------- | ----------------------------------------------------------------------- |
| `value`  | `string` | **true**  | The string to extract from                                              |
| `from`   | `number` | **true**  | The starting index for the substring                                    |
| `length` | `number` | **false** | Number of characters to return. Defaults to the remainder of the string |

## Example

**Extract the value after a delimiter**

Consider the following document:

```
{

    "msg": "result=Some value"

}
```

First, find the position of `=` with `indexOf`, then use `substr` to capture everything after it:

### Example query

* Function notation
* Method notation

```
create index_of_value from (indexOf(msg, '=') + 1)

| create value from substr(msg, index_of_value)
```

```
create index_of_value from (msg.indexOf('=') + 1)

| create value from msg.substr(index_of_value)
```

### Example output

```
{

    "msg": "result=Some value",

    "index_of_value": 7,

    "value": "Some value"

}
```