Hello all , I've configured Splunk to monitor directory , i.e. /usr/home/test/* for new CSV files ( periodically generated by cronjob) multiple files , multiple hostnames, etc.... csv file format = hostname.timestamp.csv source= /usr/home/test/rO1234560e.timestamp.csv I would like to extract host name(s) at search time from my source: as I don't have privileges to work on input / output stanza's the following regex r\w\d{7}\w will match desired host name (confirmed in regex 101). But, in Splunk, a brand new field is created as "host_N" with no value ( i.e. it's blank). |regex field source = (?)r\w\d{7}\w sourcetype = csv |regex field source = (?)r\w\d{7}\w\.\w+\.csv ) sourcetype= csv --- the same results Thanks in advance ! ... View more

I am trying to perform a ratio calculation on 2 fields (values) coming from different sources but of the same source type, Individually my searches work fine and return the correct values. But, when I combine them together, I get really weird results. Many Thanks for your help ! (sourcetype= "test" source=A host =192.168.1.1 fieldA=* ) OR source=B eval sourceA=round(fieldA/1000),2 eval sourceB=round(fieldB/1000),2 stats max(sourceA) as SA max(sourceB) as SB |eval percent_ratio=round(SA/SB,2) |stats max(percent_ratio) Legend: fieldA (sourceA), fieldB (sourceB) ... View more