The query still does not return any results and unfortunately i cant provide a sample data set due to compliance. Its strange thats its no longer working when the query hasnt changed in years. I did make a small change replacing < > with < > due to the following error. Error in 'rex' command: Encountered the following error while compiling the regex ' -(?<User>[^@]+@.*)- User is logged in.': Regex: syntax error in subpattern name (missing terminator) sourcetype=SPLUNK_REVEAL_METRICS "User is logged in." | rex field=_raw " -(?&lt;User&gt;[^@]+@.*)- User is logged in." | bucket span=1d _time | chart count by User _time ... View more