It's not clear what you're refering to. Typically with file monitor inputs, the log file path is stored in the source field. So if you want to only match events coming from this path, you should match against that field. But if you're trying to find that path part in the event data you can of course try to match on some both-sided-wildcard pattern like "*care*" but it's gonna be highly ineffective since splunk has to do a full-text raw match against all events. So please be a bit more specific what you're trying to do, what is your event format and so on. ... View more

@ITWhisperer  Appreciate your help sir. I have added the below line for getting the exact result. | eval result = fileSizeBytes-PerviousFileSizeBytes . Which stores the result in result filed.  ... View more

Thanks it worked after I disabled it. Later I have give a restart to my search head. ... View more