substr will get at part of a string, the first argument is the string to look at, the second argument specifies how many characters to skip over (0 meaning don't skip any) and the last argument is the terminator or where to stop the substring.
For an example of the parameters, say you have the following url
http://f5.com/downloads?v13
So the HTTP::uri would be "/downloads?v13"
If I put this in an iRule:
log local0. "[substr [HTTP::uri] 0 "?"] "
Will return everything up to the ? so "/downloads" would be returned.
So in /var/log/ltm you would see something similar to this:
Mar 31 09:59:34 ltm2 info tmm1[11931]: Rule /Common/test : /downloads
Hope that helps you a bit,
Dave