How to use windcard with spcial charaters to trim a field

[nirmalya2006]

Hi All

I have a field which has urls in this pattern

GET /echo/index?page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1  

I have to extract only the part "page=content" from it.
I tried to extract it using substr and rtrim but I am unable to trim contents after &.
My search string is

| eval URL = substr(field7,17) | eval URL = rtrim(URL,"^\\&*") 

Please help.

[davebrooking]

Given your example above, what should the field URL contain?

Dave

[nirmalya2006]

The field URL should contain "content".

[sundareshr]

Try regex (updated to include in code block the <url> shows correctly

  ..| rex " \?page=(?<url>[^&]+)" | ...