Different web page mentioned in the body of indexed log and another mentioned in its cs_uri_stem

[subhadipc]

I see a different web page mentioned in the body of indexed log and another mentioned in its cs_uri_stem. For example, if I search with
host="trlpws003" AND "OrchMain.aspx",
I get a list of matching records. Now, when I search with
host="trlpws003" AND cs_uri_stem ="*CustomReport.aspx"
I do not find those rows.

I need to find the response times of "*CustomReport.aspx", but since cs_uri_stem ="*CustomReport.aspx" is not working, I am not able to retrieve the same.

Please help.

[dmaislin_splunk]

So what does your output look like when you run:

host="trlpws003" AND cs_uri_stem ="CustomReport.aspx"

is the stem being extracted correctly? Can you search for:

CustomReport.aspx

What does that output look like?