Substring of URL in own field - remove everything prior to first / and everything after ?

[Seenon01]

I am trying to pull out a substring from a field and populate that information into another field. Its a typical URL http(s)://test.my.server/path/pathlook/more/etc?querystring - I have tried rex and other ltrim methods to just pull out the /path/pathlook/more/etc, I want to keep everything from the end of server to the ? My current search is below - with results - Only able to get out the Https:// at this point. Any Suggestions?

eventtype=webpageview | eval ReferralURL = cs_Referer | eval "ReferralURL"=mvindex(split('ReferralURL',"?"),0), ErrorURLFlag = if(like(ReferralURL, "%/Error.aspx%"),1,0), ShortReferralURL1 = ltrim(ReferralURL, "https://.") | stats count by cs_uri_stem, ErrorURLFlag,ReferralURL,ShortReferralURL1 | fields , ReferralURL, ErrorURLFlag,ShortReferralURL1

https://afs-sbx-www1.afsdev.work/2010/WebDFIInternal/Interface/DFIFolder/AuditResolutions.aspx 0 afs-sbx-www1.afsdev.work/2010/WebDFIInternal/Interface/DFIFolder/AuditResolutions.aspxtutionSearch.aspx 0 afs-sbx-www1.afsdev.work/2010/WebDFIInternal//Interface/DFIFolder/InstitutionSearch.aspx

[cpetterborg · Accepted solution]

Using your example and what you appear to want to get, this works in my example (plug this in as your whole search to see the results):

| makeresults | eval URL="stuff http://test.my.server/path/pathlook/more/etc?querystring thing" | rex field=URL "https?://[^/]+(?P<root>/[^?\s]+)"

It returns (in the field root😞

/path/pathlook/more/etc

I don't know if you want to get the data from a field that has only the URL, but this will work either way (hence the stuff and thing in the example to show that it will work with to without it). It also works it there is no ? and anything else after it.

[Seenon01]

Was just what i needed to get this finished up. Thanks!