I'm trying to create a timechart that tracks the total count of 3 different areas of error per day. I've regexed out each type which works fine, but I cannot get a timechart to work at all. This is my current splunk search: host="hostname" sourcetype=sourcetypename "[ERROR]" | rex field=_raw "\.php\:\d+\n(?P<StackTraceError>.*)\:\n" | rex field=_raw "\\\LdapServiceProvider\:\:(?P<IncorrectUsernameOrPassword>.+)\s" | rex field=_raw "\s\-\sTraceyId\:\"(?P<AppError>.+)\-\d.+\"\s\-\-" Any ideas? ... View more