Search an endpoint ending with numbers

[newtosplunk14]

I want to search for endpoints  /api/work/12345678 i.e api/work/(8 digt number). My below query gives me all the three endpoint in the logs. I just only want the ones that are  /api/work/12345678. 

Search Query - cf_app_name="preval" cf_space_name="prod" msg="*/api/jobs/*" 

My logs contain

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/data HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678 HTTP/1.1"  200 0 407 "-" "Java/1.8.0_222"

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/photo HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

Thanks

[newtosplunk14]

Thanks heaps @venkatasri  and @ITWhisperer . both your solutions worked brilliantly!

[newtosplunk14]

Thanks for your response Venkatasri. I tried but still returns all the events. I want the query to return one the first event in my log below.

my log is as below. 

msg: timestamp="2021-08-06T08:55:56.091Z", local_host="3deb5c54-c5f9-446d-6136-89ee", status="200", remote_host="70.132.29.36", client_id="7012430", subject_id="NO_SUBJECT_ID", service_access_id="ACCESS_USER", billing_event_sent="false", execution_time="3", uri="/api/work/16898540", app_env="prod", usage_log="preval"

msg: timestamp="2021-08-06T08:55:56.091Z", local_host="3deb5c54-c5f9-446d-6136-89ee", status="200", remote_host="70.132.29.36", client_id="7012430", subject_id="NO_SUBJECT_ID", service_access_id="ACCESS_USER", billing_event_sent="false", execution_time="3", uri="/api/work/16898540/data", app_env="prod", usage_log="preval"

[venkatasri · Accepted solution]

@newtosplunk14  try this

cf_app_name="preval" cf_space_name="prod" | regex uri="\/api\/work\/\d+$"

[ITWhisperer]

cf_app_name="preval" cf_space_name="prod" | regex "uri=\"\/api\/work\/\d+\""

[ITWhisperer]

If msg is a field which is already extracted, you can use this - note the \s in the pattern to terminate the URI

cf_app_name="preval" cf_space_name="prod" | regex msg="\/api\/work\/\d+\s"

[venkatasri]

Hi @newtosplunk14 

Try this,

cf_app_name="preval" cf_space_name="prod" | regex "\/api\/work\/\d+"

--

An upvote would be appreciated and Accept solution if this reply helps!