Sure! This isn't a Splunk thing per se, but rather more about how to post your question here. It looks like part of your rex command is getting eaten up by the formatting here, so it's hard to diagnose.
When you post code, it's best to click the button that looks like 101010 so that your code can be escaped and all characters preserved. If you can't find that button, you can use a single backtick (the character at the top left of your keyboard, on the same key as the ~ tilde) before and after your code.
