Greetings @pjtbasu,
As you said, you'll want to regex them out. The beginning of the regex replace command for all of them would be | eval URI = replace(URI, . followed by:
/account/#####/details = "(/account)/[^/]+(/details)", "\1\2")
/public/account/#####/transactions = "(/public/account)/[^/]+(/transactions)", "\1\2")
Here's a run-anywhere search for your sample data:
| makeresults
| eval URI="/account/100123445/details"
| append [ | makeresults | eval URI="/public/account/XYZAASWDDSSSS/transactions" ]
| eval URI = replace(URI, "(/account)/[^/]+(/details)", "\1\2")
| eval URI = replace(URI, "(/public/account)/[^/]+(/transactions)", "\1\2")
... View more