Archive

Different web page mentioned in the body of indexed log and another mentioned in its cs_uri_stem

subhadipc
Explorer

I see a different web page mentioned in the body of indexed log and another mentioned in its cs_uri_stem. For example, if I search with
host="trlpws003" AND "OrchMain.aspx",
I get a list of matching records. Now, when I search with
host="trlpws003" AND cs_uri_stem ="*CustomReport.aspx"
I do not find those rows.

I need to find the response times of "*CustomReport.aspx", but since cs_uri_stem ="*CustomReport.aspx" is not working, I am not able to retrieve the same.

Please help.

Tags (1)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

So what does your output look like when you run:

host="trlpws003" AND cs_uri_stem ="CustomReport.aspx"

is the stem being extracted correctly? Can you search for:

CustomReport.aspx

What does that output look like?

0 Karma