Scan command irule with URI encoding

That's how the findstr command works. The first parameter is the character or string to start collecting from. The second parameter is the number of characters to skip once you've found the character or string in the first parameter. And the third option is where or when to end collecting. So for example, the string

this is a [test]

would return "test" from the above findstr example. It starts collecting at the first occurrence of a "[", skips that 1 character, and stops collecting at the first occurrence of "]" after that. Here's another example using a distinguishedName value:

set mycn "CN=bob.user,ou=myou,o=myorg,dc=mydomain,dc=com"

log local0. [findstr $mycn "CN=" 3 ","]

It starts collecting at "CN=", skips these 3 characters, and stops collecting at the next comma, resulting in:

bob.user

Make sense?