tstats and regex usage

[sathiyamoorthy]

Executed a tscollect with two fields 'URL' and 'download size', how to extract URLs which matches particular regex.

It's straight forward to filter using regex when processing raw data as ( fields are already defined):

sourcetype="access_data" | regex URL="http://certain-type-only.*blah" | eval ...


How to do the same with tstats ? Tried replacing sourcetype section with tstats but it didn't work, is it possible to use regex in where column or any other method?

[okrabbe_splunk]

You can filter using the tstats command.

| tstats avg(size) from ts_namespace where URL="http://certain-type-only.*blah" groupby URL

When you generate tsidx files you need to access them using tstats.

Note, I did at first try using match because the docs claim that the "where" syntax is the same as general search but this does not appear to be true.