Given my apache access_log URI is /Foobar/FoobarServices, I want to extract Foobar only for my timechart. makemv delim="/" allowempty=t uri returns Foobar and FoobarServices. All I want is the Foobar. How do I do that?
makemv delim="/" allowempty=t uri | timechart count by uri
Are you just trying to extract information between the / and create a new field?
sourcetype="access_combined" | rex field=uri "^/(?
Something like this?