SUBSTRING

Returns a substring of a string, specified by a start position and an optional
length. This example returns the first three characters of every last name:
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
```

A negative start position is interpreted as being relative to the end of the
string. This example returns the last three characters of of every last name:
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
```

If length is omitted, substring returns the remainder of the string. This
example returns all characters except for the first:
```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)
```
