Help me with Regex

[SabariRajanT]

Hi Team, Am trying to write a regex function to remove the logs post / slash everything. The sample logs are here:
Sample logs:
1) ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D
2)win-extension.femrerere.grammarly.io/batch/import

The / logs are not same. they are dynamic. 

Expected post Regex: ws.chatgpt.com
win-extension.femetrics.grammarly.io

Can someone please help me to write a regex for the same.

[PrewinThomas]

@SabariRajanT 

If you don't want to create new field, use simple rex mode=sed

| makeresults
| eval url="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758"
| rex field=url mode=sed "s:/.*::"
| table url

If you want to create new fields like domain/url for creating any visualization/reporting use below,

| makeresults count=1
| eval raw_log="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D,win-extension.femrerere.grammarly.io/batch/import"
| makemv delim="," raw_log
| mvexpand raw_log
| rex field=raw_log "^(?<domain>[^/]+)"
| table raw_log domain

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[glass]

Hi,
you can try this: 

| makeresults format=csv data="url
ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D
win-extension.femrerere.grammarly.io/batch/import
" 
| rex field=url "^(?<url_short>[^\/]+)" 
| table url, url_short

[richgalloway]

Try this SPL command 

| rex mode=sed "s:([^\/]+):\1:"

To make the change at index time, put this in props.conf:

[mysourcetype]
SEDCMD-postSlash = s:([^\/]+):\1: