https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56105#M179835 <P>Ah. Updated my answer with a corrected regex.</P> Thu, 06 Dec 2012 12:37:22 GMT Ayn 2012-12-06T12:37:22Z https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56102#M179832 <P>Need to exclude the query parameters from a URL field. <BR /> For e.g. the field contains <A href="http://www.google.com/india?search=splunk">http://www.google.com/india?search=splunk</A>. I need to substring this such that result field only contains <A href="http://www.google.com/india">http://www.google.com/india</A> i.e. remove the part following "?" character. Tried using the eval and the replace functions but did not work...</P> Thu, 06 Dec 2012 12:18:36 GMT https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56102#M179832 gassershaun 2012-12-06T12:18:36Z https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56103#M179833 <PRE><CODE>... | rex field=your_url_field "^(?&lt;your_new_url_field&gt;.+?)\?" </CODE></PRE> Thu, 06 Dec 2012 12:20:53 GMT https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56103#M179833 Ayn 2012-12-06T12:20:53Z https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56104#M179834 <P>Thanks it works.. however one small problem I get the result as <A href="http://www.google.com/india">http://www.google.com/india</A>? and not as <A href="http://www.google.com/india">http://www.google.com/india</A> I also need to get rid of the ending ?</P> Thu, 06 Dec 2012 12:35:26 GMT https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56104#M179834 gassershaun 2012-12-06T12:35:26Z https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56105#M179835 <P>Ah. Updated my answer with a corrected regex.</P> Thu, 06 Dec 2012 12:37:22 GMT https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56105#M179835 Ayn 2012-12-06T12:37:22Z https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56106#M179836 <P>Ayn's answer fails if the URL does not include a question mark. Here is a regex that works for URLs with and without a question mark:</P> <P><CODE>| rex field=your_url_field "^(?&lt;your_new_url_field&gt;[^?]+)</CODE></P> Wed, 14 Mar 2018 18:04:01 GMT https://community.splunk.com/t5/Splunk-Search/Remove-the-query-string-from-a-Url-field/m-p/56106#M179836 zsteinkamp_splu 2018-03-14T18:04:01Z