topic Remove first word with rex in Splunk Search

Remove first word with rex

JohannesGmelin — Wed, 07 Jun 2017 11:01:34 GMT

Hey Community,

I'm trying to remove the first word of a Uri with a rex.

/test/contentA/contentB.html

It should only display something like this:

contentA/contentB.html

How can I deal with this?

dineshraj9 — Wed, 07 Jun 2017 11:10:36 GMT

Do it this way -

| rex field=field1 "\/\w*\/(?<field1 >.+)"

JohannesGmelin — Wed, 07 Jun 2017 11:23:30 GMT

This worked for me:

s/\/\w*\/(.+)$/\\1/

Thanks for your thought for thought.