https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656433#M11680 <P>Your question is rather vague, but assuming you want the beginning of the _raw event field up to but not including the first | you could try this</P><LI-CODE lang="markup">| rex "^(?&lt;url&gt;[^\|]+)"</LI-CODE> Fri, 01 Sep 2023 13:15:48 GMT ITWhisperer 2023-09-01T13:15:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656431#M11679 <P>&nbsp;</P><P>HI ,</P><P>please help to get new field URI by using rex&nbsp;</P><P><BR /><BR /></P><P>/area/label/health/readiness||||||||||METRICS|--</P> Fri, 01 Sep 2023 12:56:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656431#M11679 lucky 2023-09-01T12:56:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656433#M11680 <P>Your question is rather vague, but assuming you want the beginning of the _raw event field up to but not including the first | you could try this</P><LI-CODE lang="markup">| rex "^(?&lt;url&gt;[^\|]+)"</LI-CODE> Fri, 01 Sep 2023 13:15:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656433#M11680 ITWhisperer 2023-09-01T13:15:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656434#M11681 <P>Hi</P><P>this should works</P><LI-CODE lang="markup">... | rex "(?&lt;URI&gt;^[^\|]+)"</LI-CODE><P>&nbsp;I assume that your event is in _raw. If it's already in some field then just add "fields=&lt;your field&gt;" after rex.</P><P><A href="https://regex101.com/r/IsMwQy/1" target="_blank">https://regex101.com/r/IsMwQy/1</A></P><P>r. Ismo</P> Fri, 01 Sep 2023 13:16:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/rex-fields/m-p/656434#M11681 isoutamo 2023-09-01T13:16:19Z