Taking an example below, I am looking to be make a regular expression that will give me name of servlet form below (after last slash and first question mark).
URL:
/shop/mystore/ProductDisplay?urlRequestType=Base
Result:
ProductDisplay
try this if say your url is in field myField
your query to return the events
| rex field=myField "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet
If the field is not already extracted then try it generally with or without string field=_raw
in below query:
your query to return the events
| rex field=_raw "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet