Hi
Try this rex
| makeresults
| eval url="fqdn/A/B/C/file.png"
| rex field=url "^(?P<test>.*[\/])"
| eval result = replace(test,"\/$","")
There are many ways to do this, including:
... | rex field=url mode=sed "s/\/[^\/]+$//"
Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!
The trim
function doesn't do what you think it does, although it would be nice if it did.
There are other ways to accomplish the task. The URL Toolkit app will parse the URL for you and let you choose any part(s) you like.
The rex
command can do it, too.
... | rex field=url "(?<url>.*)\/"
Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!
You can UpVote
as many answers or comments as you like, especially those that taught you something new and worked.
Try this!
| makeresults |eval url="FQDN/A/B/C/file.png"
| eval object=mvindex(split(url,"/"),mvcount(split(url,"/"))-1)
| eval url=rtrim(url,"/"+object)
Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!
Hi
Try this rex
| makeresults
| eval url="fqdn/A/B/C/file.png"
| rex field=url "^(?P<test>.*[\/])"
| eval result = replace(test,"\/$","")
Thanks so much! This worked!
Slightly simplified version:
| makeresults
| eval url="fqdn/A/B/C/file.png"
| rex field=url "^(?P<result>.*)/[^/]+$"