Browsing: substring function in Splunk