Hello,    I am running the following query.  index=sys_tools_ecc-appd application_name=CAPRI-1130 | table * | search source=business_transactions business_transactions.metricName="*Average Response Time (ms)*" | timechart avg(business_transactions.metricValues{}.value) by business_transactions.metricPath   The business_transactions.metricPath names are all too long example below: 1. Business Transaction Performance|Business Transactions|APP|/dbq/ecrud|Average Response Time (ms) 2. Business Transaction Performance|Business Transactions|APP|/dbq/BTSXDRRequest_PortTypeWS|Average Response Time (ms)   Need to trim them from both side. I need to remove  "Business Transaction Performance|Business Transactions" from the front and "|Average Response Time (ms)" from the back before displaying them on column.        ... View more

  index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms*| rex field=_raw "\"\"https://case.mibams.ba.com/api/(?P<API>.*)\"\"\sTIME.*" | dedup API | table API       I have following cmd helps me rex information after api  in url for 2 /"/" Example,  ms_reports/retrieve.    I need the api to end with / or ?.    ms_odata_svc/temp_rcvbl_grids?%24top=201&%24filter=CALL_ID%20eq%20%27VBABOIMcbriJ-40574153%27&%24orderby=RCVBL_TYPE_NM%2CDSCVRY_DT%20desc%2CRCVBL_ID%20desc%2CRCVBL_TRAN_NBR&%24count=false&%24select=AWARD_BENE_TYPE_NM%2CAWARD_TYPE_NM%2CBAL_AMT%2CBENE_NM%2CDSCVRY_DT%2CFACILITY_CD%2CFILE_NBR%2CHOME_LOAN_RFRNC_NBR%2CINT_BAL_AMT%2CLEDGER_ACNT_TYPE_NM%2CLOAN_ID_NBR%2CLOAN_ORGTN_DT%2CORIGNL_AMT%2CRCVBL_ID%2CRCVBL_TRAN_NBR%2CRCVBL_TYPE_NM%2CREPYMT_AMT%2CSSN_NBR%2CTAX_ID_NBR ... View more