See the rex statement here
| makeresults
| eval urls=split("a/b/c,a/b/c/d,a/b/c/d/e",",")
| mvexpand urls
| rex field=urls ".*/(?<resource>.*)"
See the rex statement here
| makeresults
| eval urls=split("a/b/c,a/b/c/d,a/b/c/d/e",",")
| mvexpand urls
| rex field=urls ".*/(?<resource>.*)"