How to return a url only to the 2nd slash?

[isxtn]

So, this PCRE regex works in testers, but not on Splunk. 

^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

Should return https://someurl.com/first/

BUT in Splunk search, this:

rex field=referer "referer=(?<referer>^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

is returning the entire url, i.e., https://someurl.com/first/second/third/fourth/etc

What's the proper way to get what I'm looking for? Confused that this works in testers but not Splunk.

[isxtn]

Thanks!

[jotne · Accepted solution]

Just count 4 /

| makeresults 
| eval url="https://someurl.com/first/second/third/fourth/etc"
| rex field=url "(?<test>^(?:[^\/]*\/){4})"