Use of double qoutes in rex command arguments fails alerts in windows environment.

[xli_splunk]

Set up an alert with the search command:
source="C:\test\data\log1.txt" | rex v="(?.*)" | head 10
the alert has never been triggered, although the same search on Aplunk UI generates results.

[ibob0304]

You should have tried by black slash \"(?.*)\"

[xli_splunk]

So don't use double quotes with rax command in scheduled searches for alerts. Just use a search like:
source="C:\test\data\log1.txt" | rex v=(?.*) | head 10
This works fine for alerts and is more readable.

[ibob0304]

  " works fine on windows.