If I correctly understood your logic, it isn't exactly how Splunk is interpreting your query, although the selected events will probably be the same. Your base search, index=* host="storelog*" "store license for " will extract all events which have the "store license for " string, including the single whitespace. Then it will run the rex over all the selected commands, and the regex will try the match starting from the beginning of the event, not from where you stopped from the previous command. To overcome the newline issue, check if it is possible given your dataset to run something like this: index=* host="storelog*" "store license for Store 123456" | rex field=_raw "\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}\s(?P<errortext>.*)path" | stats count by errortext The "Store 123456" was moved to the main search, and the regex will try to match starting from the timestamp. Also you should probably look over this data input parameters, as the raw events doesn't look to have the right boundaries from what you showed here.
... View more
