Executed a tscollect with two fields 'URL' and 'download size', how to extract URLs which matches particular regex.
It's straight forward to filter using regex when processing raw data as ( fields are already defined):
sourcetype="access_data" | regex URL="http://certain-type-only.*blah" | eval ...
How to do the same with tstats ? Tried replacing sourcetype section with tstats but it didn't work, is it possible to use regex in where column or any other method?
You can filter using the tstats command.
| tstats avg(size) from ts_namespace where URL="http://certain-type-only.*blah" groupby URL
When you generate tsidx files you need to access them using tstats.
Note, I did at first try using match because the docs claim that the "where" syntax is the same as general search but this does not appear to be true.