Hello FelixL, I have the same problem as you. Did you find out why it happened and how to fix it? If you change the locale in the url, it will sometimes start working. For example, en-US to en-GB ... View more

Have you eliminated app permissions/shares at the user level?  The saved search may run as user or as a default account(noone). The btool has a switch for "-- user" which I'm not 100% familiar with but the docs do warn about having to use the switch "--app" as well, but then says the switch user does not consider knowledge object permissions when evaluating the user. ... View more

I tried the change and It does not help. You can se on first screenshot. You were right that the trigger could be the colon. If I remove the ":" from field and calculate the stat then all mvfield displayed the same way. It doesn't completely solve my problem.  ... View more

"READ: \S+ (/[^/]+)*/(?<filename>[^\s/]+) Rex is about compromises.  I have to make a few assumptions based on the illustrated sample data. "READ:" is perhaps a keyword and doesn't change from event to event. "*MDTM" is perhaps a classifier that may take different forms but that does not contain space. (\S) The path before file name is absolute, and can vary in depth. (See below.) File name contains no space. ([^s])  By convention, file name also does not include a path separator. (Combined with no space, that's [^\s/]) After file name, there is either a space or end of the line. The expression contains two different repetition tokens.  + means repeat at least once, up to any number of times.  * means repeat zero to unlimited times.  Parentheses in standard regex is just grouping.  So, (/[^/]+)* matches /abc, /abc/def, /abc/def/ghi; but (/[^/]+)* zero-length string, so (/[^/]+)*/ also matches /. Hope this helps. ... View more