Is there a way to trim URL string from a table?

[jrevolorio]

So, I want to create a table where it shows the time, source IP, and URL.

sourcetype=* src_ip=* url=* | table _time, src_ip, url

The search runs fine however the URL comes back with a long string.

Example= https://www.google.com/xxx_xxx?atyp=csi&ei=tWelWaipKMOJmQGb_Lr4Cg&s=newtab&action=update&ima=1&ime=0...

Is there a way to trim the string from the URL to only show up to google.com/xxx_xxx?

[niketn]

You can also try replace() function with regular expression pattern

sourcetype=* src_ip=* url=* 
| table _time, src_ip, url 
| eval url=replace(url,"(^[^\?]+)(\?.*)","\1")

[somesoni2 · Accepted solution]

Try like this

sourcetype=* src_ip=* url=* | table _time, src_ip, url | eval url=mvindex(split(url,"?"),0)

OR

sourcetype=* src_ip=* url=* | table _time, src_ip, url | rex field=url "^(?<url>[^\?]+)"

[jrevolorio]

Thanks! Worked like a charm