How to resolve the parsing of key value pairs in a URL?

[joepappano]

I have log data that contains URLs like the example below. The automatic parsing of key value pairs works very well. All of the key value pairs after the question mark are parsed correctly, I see a field for every key after the question mark.

url=http://path/to/data.ext?Platform=val&AppName=val&AppVersion=val&AssetID=val&AssetType=val&MvpdID=val&IsPrimary=val&IsDR=val

The problem is that the query string in the URL field (everything before the ?) looks like the following. It always has the first key/value pair after the ?

http://path/to/data.ext?Platform=val

Trying to figure out the best way to make the URL field consistently have just the search string.
I've used a regex similar to this: | rex field=url mode=sed "s/\?.*//" Is there a better way?

Search head version 6.4.2

Hope this is enough info. Happy to provide more if needed.

[sundareshr]

If you only want the querystring (everything after the ?), try this

s/(.*)\?(.*)/\2/g

and for everything before the ?, use this

s/(.*)\?(.*)/\1/g