How to search for the exact URI with wildcards within the URI field?

[Splunk_SachinKu]

Hi All,

I have following URI in my logs.

/svc/appName/1234567890/catalog/search/(status),
/svc/appName/1234567890/catalog/search/(info)
/svc/appName/1234567890/catalog/search/(update),
/svc/appName/1234567890/catalog/search/

where 1234567890 is user id. I would like to search for /svc/appName//catalog/search/.

I am using following to search
index=jboss sourcetype=jboss_tomcat_access_log /catalog/search/.

But it returns all of the above URIs.

How would I search for the exact URI for all the user ids?

Thank You!

[richgalloway]

You're searching for text that appears in all events so you will get all events in your results. To narrow the results, add qualifiers to your search. Is the URI in a field? If so, you can try

index=jboss sourcetype=jboss_tomcat_access_log /catalog/search/ | where like(URI,"%/catalog/search/" | ...

Otherwise, try

index=jboss sourcetype=jboss_tomcat_access_log /catalog/search/ NOT "/catalog/search/(*"

to exclude events that have parens near the end.