Hi Everyone:
I'd like to extract everything after the third "/" below (starting from the left) in the url field below:
url=http://4.3.3.4/pld_accepted_business "
Note: http://4.3.3.4/ will be constant. The latter may change between pld_accepted_business or pld_accepted_non_business"
Any assistance would be greatly appreciated.
Hi @mdeterville Please check this..
| makeresults
| eval log="url=http://4.3.3.4/pld_accepted_business"
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion
Hi @mdeterville Please check this..
| makeresults
| eval log="url=http://4.3.3.4/pld_accepted_business"
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion
This works! Thanks for the quick turnaround @inventsekar!
| makeresults
| eval url=split("http://4.3.3.4/pld_accepted_business",",")
| mvexpand url
| rex field=url ".*\/+.*\/(?<new>.*)"