What rex to use for the extraction of virtual from URI?

[lbonnes]

These two cells are examples of results I see in IIs logs. 

If the field is just a / (backslash) ( as in the first example data cell ) I want to return just the /. 

If there are characters after the first / (like search in #2) , I need to return the text between the backslashes.  

/

/search/20191108/master.svc

My results would look like this. 

field1

root   

search

[richgalloway]

This should do it.

| rex "\/(?<field1>[^\/]+)"
| eval field1=if(isnull(field1) OR field1="","root", field1)

  The rex command grabs everything between the first two slashes.  The eval command presumes a missing or empty field1 means the root was specified.