So, I want to create a table where it shows the time, source IP, and URL.
sourcetype=* src_ip=* url=* | table _time, src_ip, url
The search runs fine however the URL comes back with a long string.
Example= https://www.google.com/xxx_xxx?atyp=csi&ei=tWelWaipKMOJmQGb_Lr4Cg&s=newtab&action=update&ima=1&ime=0...
Is there a way to trim the string from the URL to only show up to google.com/xxx_xxx?
Try like this
sourcetype=* src_ip=* url=* | table _time, src_ip, url | eval url=mvindex(split(url,"?"),0)
OR
sourcetype=* src_ip=* url=* | table _time, src_ip, url | rex field=url "^(?<url>[^\?]+)"
You can also try replace() function with regular expression pattern
sourcetype=* src_ip=* url=*
| table _time, src_ip, url
| eval url=replace(url,"(^[^\?]+)(\?.*)","\1")
Try like this
sourcetype=* src_ip=* url=* | table _time, src_ip, url | eval url=mvindex(split(url,"?"),0)
OR
sourcetype=* src_ip=* url=* | table _time, src_ip, url | rex field=url "^(?<url>[^\?]+)"
Thanks! Worked like a charm