Thank you for all the assistance. The issue was actually the transforms file. When I gave the "URL" string, that was actually me looking at the _raw output and seeing it. When I did | table URL , what I actually saw was ManageAccount.do?ACTION=VIEW . We (read an admin from a long time ago) handrolled one of our sourcetypes, and the parsing is jacked on it.
My solution?
rex field=_raw "URL=(?[^;]*)"
Then real_uri is equivalent to what I thought URL was. sigh Well, there's a day of work wasted. Thanks again everyone!
... View more