FYI, and as a supplemental to the above answer, I keep my files in the following directory: /var/splunk/input/mms_logs/ The filename structure is: mms_HOST-IP-ADDRESS_TIMESTAMP.log examples: mms_10.152.58.100_20110101_004000_06137.log mms_10.152.58.194_20110121_120000_70656.log Now to extract the IP address portion of filename as a host, I used the following regex: /var/splunk/input/mms_logs/mms_(\d+.\d+.\d+.\d+)_\d+ Voila! From the above examples I know have two hosts (10.152.58.100 & 10.152.58.194), along with all of the events that are hosted within the files 🙂 Hope this helps someone! ... View more