The problem had something to do with the rex command. This was my rex command: | rex field=_raw "Issuer=\"(?.+)\";File" Some of the variables around the Issuer variable just were not being caught, but when I changed it to this: | rex field=_raw "Issuer=(?.+);File" Everything gets caught. I believe this is a bug because I can have the '\"' on either side, but not both. I also tried using '\S' on both sides and that also does not capture everything. It also is not an issue with the string being captured because looking at the stats I can see that the number of individual Issuers caught does not change, but the number each individual one appears gets lowered slightly. ... View more