Answer by warren for Using Regex to specify delimited fields?

You might consider using a combination of the eval functions split and mvindex:

index=ndx sourcetype=srctp url=*
| eval url_parts=split(url,"/")
| eval segment=mvindex(url_parts,4)

from User warren – Stack Overflow https://stackoverflow.com/questions/71326356/using-regex-to-specify-delimited-fields/71329606#71329606
via IFTTT