You can use the rex command to extract a new field from your data. because i dont have complete view into your data to see all the possible combinations i made this generic regex that will get your close to what you need ("/RevWebServices/resources/*/* HTTP/1.1" OR "/RevWebServices/resources/secure/*/v*/* HTTP/1.1") | rex "(?:"PUT|GET) (?<newfieldname>.*?)(?:\s|\?)" this should extract a new field called "newfieldname" with the following values based on your examples above /source1/resources/RESOURCE/ENDPOINT/1111/start /source1/resources/RESOURCE/ENDPOINT /source1/resources/secure/RESOURCE/v1/ENDPOINT ... View more