'What is the best way to specify/access a specific item in a delimited field in Splunk?

I'm very new to regex and such, I have tried to look for a similar answer but nothing jumping out to me.

I'm trying to refine searches in Splunk using a regex. Is there any way that I can define delimited fields and only focus on that area? For example:

hxxps://example.com/examplefolder/examplestring/

I wanted to match conditions only within <examplestring> field, I understand that using $ will set the end of the string however I need to only match if it is the 'fourth' field from the start of the string, if the delimiter was '/'

So far I am just using \/[a-zA-Z0-9]{10,15}\/$ to match characters between 10 and 15 in length, it matches based on that last field but other entries match this such as:

hxxps://example.com/examplestring2/

Is there a recommendation as to how I can use regex to focus the matching to a set 'field' (field4) of the string using '/' as a delimiter please?

hxxps:/<field1>/<field2>/<field3>/<field4>/<field5>

I have confused myself just trying to explain what I'm after so please feel free to probe me I'm making no sense.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source