Help with search to create a table

[BaharJ]

Hello folks,
I am new to Splunk and need to get a report in CSV file or table.
I like to see only URL and values of parameters in A, B, C, or D column.
There is a chance to have combination of these parameters in URL.
i.e: http//www.XX.com/YY/form/ZZ/test1.html?A=*&B=&C=*&D=
i.e: http//www.XX.com/YY/form/ZZ/test2.html?A=&B=*&C=*
i.e: http//www.XX.com/YY/form/ZZ/test3.html?C=&D=*
All factorial combination of parameters should be show in the report and escape duplicate ones.

This is my sample query:

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host = "public*web*" "GET //www.XX.com/YY/" AND "/form/ZZ/" AND "/form/" AND ("A=" OR "B=" OR "C=" OR "D=") | rex field=_raw "A=(?[^&]) B=(?[^&]) C=(?[^&]) D=(?[^&])" | dedup A | fields host,url,A,B,C,D | table host url A B C D

[DalJeanis]

Try this -

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host="public*web*" 
"GET //www.XX.com/YY/" AND "/form/ZZ/" AND "/form/" AND ("A=" OR "B=" OR "C=" OR "D=") 
| rex field=_raw "html\?.*?A=(?<AParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?B=(?<BParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?C=(?<CParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?D=(?<DParm>[^&]+)(&|$)"
| fillnull value="((none))" AParm BParm CParm DParm
| dedup AParm 
| fields host, url, AParm, BParm, CParm, DParm 
| table host, url, AParm, BParm, CParm, DParm 

If you want cases where a parameter is present but empty, change the + to * in each rex.

[BaharJ]

Thanks for your reply Dal, I have tried different query to make it more clean and simple.
Even this new one gives me same result as top one you shared: (queryParam names are the same, no need to have line 3 to 6), thanks for idea about null values.
Now my missing part is URL, it is not returning the full uel or even some of them are showing null but returning parameter in columns!!
| rex field=_raw "http://(?\/[^?])"
| rex field=_raw "http://(?[^\s]+)\s"
I have consider both of these none of them works fine! (Not able to post < + U + R + L + > after ?)
I was expecting url is returning the real url address! I need to have i.e http//www.XX.com/YY/form/ZZ/test1.html in my table. Or maybe full address with parameter should work fine. i.e. : http//www.XX.com/YY/form/ZZ/test3.html?C=&D=*

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host="public*web*"
"GET //www.XX.com/YY/" AND "/form/"
| rex field=_raw "http://((?[^\s]+)\s"
| fillnull value="N/A" AParm BParm CParm DParm
| dedup AParm
| fields URL AParm BParm CParm DParm
| table URL, AParm, BParm, CParm, DParm