Hi All
I have a field which has urls in this pattern
GET /echo/index?page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1
I have to extract only the part "page=content" from it.
I tried to extract it using substr and rtrim but I am unable to trim contents after &.
My search string is
| eval URL = substr(field7,17) | eval URL = rtrim(URL,"^\\&*")
Please help.
Given your example above, what should the field URL contain?
Dave
The field URL should contain "content".
Try regex (updated to include in code block the <url>
shows correctly
..| rex " \?page=(?<url>[^&]+)" | ...