Using REGEX to extract portion of a string from a field

[mdeterville]

Hi Everyone:

I'd like to extract everything after the third "/" below (starting from the left) in the url field below:

url=http://4.3.3.4/pld_accepted_business "

Note: http://4.3.3.4/  will be constant. The latter may change between pld_accepted_business  or pld_accepted_non_business"

Any assistance would be greatly appreciated.

[inventsekar · Accepted solution]

Hi @mdeterville Please check this.. 

| makeresults 
| eval log="url=http://4.3.3.4/pld_accepted_business" 
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion

[mdeterville]

This works! Thanks for the quick turnaround @inventsekar!

[admin12345678]

| makeresults
| eval url=split("http://4.3.3.4/pld_accepted_business",",")
| mvexpand url
| rex field=url ".*\/+.*\/(?<new>.*)"