https://community.splunk.com/t5/Splunk-Search/tstats-and-regex-usage/m-p/85828#M21907 <P>You can filter using the tstats command. </P> <PRE><CODE>| tstats avg(size) from ts_namespace where URL="http://certain-type-only.*blah" groupby URL </CODE></PRE> <P>When you generate tsidx files you need to access them using tstats.</P> <P>Note, I did at first try using match because the docs claim that the "where" syntax is the same as general search but this does not appear to be true.</P> Mon, 08 Apr 2013 18:15:34 GMT okrabbe_splunk 2013-04-08T18:15:34Z https://community.splunk.com/t5/Splunk-Search/tstats-and-regex-usage/m-p/85827#M21906 <P>Executed a tscollect with two fields 'URL' and 'download size', how to extract URLs which matches particular regex.</P> <P>It's straight forward to filter using regex when processing raw data as ( fields are already defined):<BR /> <CODE><BR /> sourcetype="access_data" | regex URL="<A href="http://certain-type-only.*blah">http://certain-type-only.*blah</A>" | eval ...<BR /> </CODE></P> <P>How to do the same with tstats ? Tried replacing sourcetype section with tstats but it didn't work, is it possible to use regex in where column or any other method?</P> Fri, 05 Apr 2013 11:04:42 GMT https://community.splunk.com/t5/Splunk-Search/tstats-and-regex-usage/m-p/85827#M21906 sathiyamoorthy 2013-04-05T11:04:42Z https://community.splunk.com/t5/Splunk-Search/tstats-and-regex-usage/m-p/85828#M21907 <P>You can filter using the tstats command. </P> <PRE><CODE>| tstats avg(size) from ts_namespace where URL="http://certain-type-only.*blah" groupby URL </CODE></PRE> <P>When you generate tsidx files you need to access them using tstats.</P> <P>Note, I did at first try using match because the docs claim that the "where" syntax is the same as general search but this does not appear to be true.</P> Mon, 08 Apr 2013 18:15:34 GMT https://community.splunk.com/t5/Splunk-Search/tstats-and-regex-usage/m-p/85828#M21907 okrabbe_splunk 2013-04-08T18:15:34Z