Splunk Search

Remove first word with rex

Path Finder

Hey Community,

I'm trying to remove the first word of a Uri with a rex.

/test/contentA/contentB.html

It should only display something like this:

contentA/contentB.html

How can I deal with this?

0 Karma
1 Solution

Builder

Do it this way -

| rex field=field1 "\/\w*\/(?<field1 >.+)"

View solution in original post

0 Karma

Builder

Do it this way -

| rex field=field1 "\/\w*\/(?<field1 >.+)"

View solution in original post

0 Karma

Path Finder

This worked for me:

s/\/\w*\/(.+)$/\\1/

Thanks for your thought for thought.

0 Karma