I'd like to extract everything after the third "/" below (starting from the left) in the url field below:
Note: http://126.96.36.199/ will be constant. The latter may change between pld_accepted_business or pld_accepted_non_business"
Any assistance would be greatly appreciated.
Hi @mdeterville Please check this..
| eval log="url=http://188.8.131.52/pld_accepted_business"
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion
View solution in original post
This works! Thanks for the quick turnaround @inventsekar!
| makeresults| eval url=split("http://184.108.40.206/pld_accepted_business",",")| mvexpand url| rex field=url ".*\/+.*\/(?<new>.*)"