I have single-line log entries that come into splunk looking like this: Apr 1 12:34:09 10.1.9.254 %ASA-4-722051: Group User IP <108.81.41.121> Address <172.31.255.91> assigned to session Each entry represents a single login. I would like to have a count of all log entries with individual names that follow in the <> after the "User" phrase. User is not a field defined so it has to be done with a rex or something at search time. The last thing I've tried is: | rex field=_raw "User\s(? )" | stats count by _raw but all I get with this is a listing of the individual log entries. ... View more