https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255933#M76641 <P>Give this a try as well</P> <PRE><CODE>your base search | eval Quota_Ratio=tonumber(mvindex(split(logical_usage," "),-1))/tonumber(mvindex(split(field13," "),-1)) </CODE></PRE> Tue, 17 May 2016 15:49:09 GMT somesoni2 2016-05-17T15:49:09Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255931#M76639 <P>Hi,</P> <P>I have 2 fields. Field1 is named field13 and Field2 is named logical_usage.</P> <P>Field1 contains "hard" : 1099511627776<BR /> Field2 contains "logical" : 664419</P> <P>I tried to extract values after the <CODE>:</CODE> and after a ratio of the usage. That's for a quota ratio.</P> <P>I tried with <CODE>| rex</CODE>, but I didn't find the right way to do it.</P> <P>Thank you for your precious help.</P> Tue, 17 May 2016 12:51:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255931#M76639 marcroyer 2016-05-17T12:51:19Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255932#M76640 <P>This rex command will extract the number.</P> <PRE><CODE>.... | rex field=field1 "\:\s*(?&lt;field1value&gt;\d+)" | rex field=field2 "\:\s*(?&lt;field2value&gt;\d+)" | table field1value field2value </CODE></PRE> Tue, 17 May 2016 14:59:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255932#M76640 sundareshr 2016-05-17T14:59:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255933#M76641 <P>Give this a try as well</P> <PRE><CODE>your base search | eval Quota_Ratio=tonumber(mvindex(split(logical_usage," "),-1))/tonumber(mvindex(split(field13," "),-1)) </CODE></PRE> Tue, 17 May 2016 15:49:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255933#M76641 somesoni2 2016-05-17T15:49:09Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255934#M76642 <P>Hi Guys, </P> <P>Thank you very much !!! It's working as expected. </P> Tue, 17 May 2016 17:12:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-these-fields-and-compare-the-values/m-p/255934#M76642 marcroyer 2016-05-17T17:12:31Z