Hi, Im having issues running 3 searches that previously worked and strangely enough by removing the double quotes on one search it worked. Search 1. Not working sourcetype=“SPLUNK_REVEAL_METRICS" "User is logged in." | rename date_mday as MonthDay | rename date_year as Year | rename date_month as Month | stats count as "Logins" by Year,Month,MonthDay Search 1. Now Working sourcetype=SPLUNK_REVEAL_METRICS | rename date_mday as Day | rename date_month as Month | rename date_year as Year | stats count as "Logins" by Day,Month,Year Not working Search 2 & 3 sourcetype=SPLUNK_REVEAL_METRICS | rename date_mday as Day | rename date_month as Month | rename date_year as Year | stats count as "Logins" by Day,Month,Year sourcetype="SPLUNK_REVEAL_METRICS" "User is logged in." | rex field=_raw " -(?<User>[^@]+@.*)- User is logged in." | eval Transaction_Date=strftime(strptime(date_year."-".date_month."-".date_mday,"%Y-%B-%d"),"%Y-%m-%d") | chart count by User Transaction_Date Any clues as to this behaviour? ... View more