Please mark my answer as accepted. ... View more

set the display.visualizations.show = 0 for that saved search inside the savedsearches.cof. This answers post also may help http://answers.splunk.com/answers/132453/pdf-chart-does-not-display-statistics-correctly.html ... View more

What I meant by columns was referring to the actual logs. index = hrfarm | rex "^(?:[^ ]* ){2}(? [^ ]+)\s" 2013-05-13 17:32:26,962 C083363 /* GUID: C083363 */ select permission1_.PermissionId as col_0_0_ from... Rex command works just not the correct position and when I change the position to either {1} or {3} its still not correct. Interesting field "account_ID" position {2} returns: GUID: or sometimes commands: position {1} returns: 2013-05-13 17:32:26,962 C083363 position {3} returns: GUID: C083363 (close but I want the first account ID value) ... View more