How to remove everything after a specific character from a field

[Shashank_87]

Hi I want to remove everything after a some characters like ? OR & when they come in a field. For example -

/temp/test?csrkyyt=12334

/test1/test2&csrkyyt=7968676

Can someone help?

[vnravikumar]

Hi @Shashank_87

Check this

| makeresults 
| eval text="/temp/test?csrkyyt=12334##/test1/test2&csrkyyt=7968676" 
| makemv delim="##" text 
| mvexpand text 
| rex field=text "(?P<output>^[^(?|&)]+)"

[manjunathmeti]

You can use rex with sed to remove all characters after ? OR &.

| rex mode=sed field=FIELD_NAME "s/[&?].*//g"

[gcusello]

Hi @Shashank_87,
you can use the rex comman, something like this:

index=my_index
| rex field=my_field "^(?<my_field>[^\&\?]*)"
| ...

that you can test at https://regex101.com/r/f8lmIs/1 .

Ciao.
Giuseppe