How to trim URL after the last "/"

[RaymondN80]

I'm trying to trim the URL's for a particular search, where it removes everything after the last "/".
In other words:

From:
fqdn/A/B/C/file.png
To Return:
fqdn/A/B/C

I tried using rtrim, but did not work for me.
Any help with this will be greatly appreciated!

[woodcock]

There are many ways to do this, including:

... | rex field=url mode=sed "s/\/[^\/]+$//"

[RaymondN80]

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

[richgalloway]

The trim function doesn't do what you think it does, although it would be nice if it did.

There are other ways to accomplish the task. The URL Toolkit app will parse the URL for you and let you choose any part(s) you like.
The rex command can do it, too.

... | rex field=url "(?<url>.*)\/"

[RaymondN80]

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

[woodcock]

You can UpVote as many answers or comments as you like, especially those that taught you something new and worked.

[HiroshiSatoh]

Try this!

| makeresults |eval url="FQDN/A/B/C/file.png"
| eval object=mvindex(split(url,"/"),mvcount(split(url,"/"))-1)
| eval url=rtrim(url,"/"+object)

[RaymondN80]

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

[vnravikumar · Accepted solution]

Hi

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

[RaymondN80]

Thanks so much! This worked!

[jacobpevans]

Slightly simplified version:

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<result>.*)/[^/]+$"