Can I have a rex ending with "/" or "?" ?

[naujla85]

index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms*| rex field=_raw "\"\"https://case.mibams.ba.com/api/(?P<API>.*)\"\"\sTIME.*" | dedup API | table API

I have following cmd helps me rex information after api  in url for 2 /"/"

Example,  ms_reports/retrieve. 

I need the api to end with / or ?. 

ms_odata_svc/temp_rcvbl_grids?%24top=201&%24filter=CALL_ID%20eq%20%27VBABOIMcbriJ-40574153%27&%24orderby=RCVBL_TYPE_NM%2CDSCVRY_DT%20desc%2CRCVBL_ID%20desc%2CRCVBL_TRAN_NBR&%24count=false&%24select=AWARD_BENE_TYPE_NM%2CAWARD_TYPE_NM%2CBAL_AMT%2CBENE_NM%2CDSCVRY_DT%2CFACILITY_CD%2CFILE_NBR%2CHOME_LOAN_RFRNC_NBR%2CINT_BAL_AMT%2CLEDGER_ACNT_TYPE_NM%2CLOAN_ID_NBR%2CLOAN_ORGTN_DT%2CORIGNL_AMT%2CRCVBL_ID%2CRCVBL_TRAN_NBR%2CRCVBL_TYPE_NM%2CREPYMT_AMT%2CSSN_NBR%2CTAX_ID_NBR

[somesoni2 · Accepted solution]

Give this a try

index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms*
| rex field=_raw "\"\"https:\/\/case.mibams.ba.com\/api\/(?<API>[^\/]+\/[^\?\/]+)"
| stats count by API | table API

[yuanliu]

Something like this will do

| rex field=URL "https://([^/]+/)api/(?<API>[^?]+)"

[naujla85]

It worked partially. Now I have get 3 sort at some places. 

The below is the cmd I am using 

index="vha_tools_oit-sales" source="sfdc_event_log://EventLog_vha_my_sales_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/* | rex field=_raw "\"\"https://case.mibams.ba.com/api/(?P<API>[^?]+)\"\"\sTIME.*"| dedup API | table API

The result is as shown below. I only need 2 // example /vi/fiducaryservice