Calculated fields happen after field aliasing (which happens after ALL field extractions) but before lookups. What you're observing here is the correct behavior and not a limitation. eval is flexible enough to allow you to wrangle and mold field/strings to the desired shape. Your first example "works" because you're not extracting anything from url after it is calculated. Your second example, as expected, does not work because you're trying to extract from an EVALed field.
Also, note that you can't EVAL an EVALed field, but nothing prevents you from making your eval statement as complex as necessary:
[psft_weblogic_access]
EVAL-url_path = replace(urldecode(url_encoded), "([^?]+).*$", "\1")
d.
... View more