Why is regex not returning any results when used in a tstats search?

[pgort]

I have a correlation search that triggers on users accessing too many URLs categorized as unknown.

| tstats allow_old_summaries=true count(Web.user) as "Count" from datamodel=Web where nodename=Web.Blocked Web.url_category="unknown" Web.rule!="Allow_Public_IP" AND Web.src_zone="TRUST" by "Web.user" 
| rename "Web.user" as "user"
| regex Web.url !="\d+\.\d+\.\d+\.\d+\/$"
| where 'Count'>100

| regex Web.url !="\d+\.\d+\.\d+\.\d+\/$" is the problem line. It does not filter out IP addresses (or anything for that matter). Right now, Cisco Spark traffic is cluttering our URL traffic logs as the "url" is an IP address with a trailing / rather than a DNS name.

I need the regex to ignore logs of just an IP followed by a slash: "10.0.0.1/" but still return all other values like: "10.0.0.1/index.html" or "google.com". I can't tell if I'm calling regex correctly for tstats or how regex sees the value of Web.url to know if I can use the $ at the end.

[sjohnson_splunk · Accepted solution]

You need to add Web.url to your tstats statement as part of the by statement otherwise the field isn't available for the regex statement.