when I run the whole command including raw, it worked for me as well. but when I run only these commands , it gives me header detail but not any value again them except dates column refer below screenshot | rex "Name=\"(?<name>[^\"]+)\"\sTime=\"(?<Date>[^\"]+)\"\sDuration=\"(?<duration>[^\"]+)\"" | eval Time=strptime(Date, "%d/%m/%Y %H:%M") | eval {name}='duration' | fields - name duration | stats values(*) as * by Date | fieldformat Time=strftime(Date, "%d/%m/%Y") | table time SIline PrimaryAddress SearchInServicing NavExistingAddresses please refer the attached actual data available in splunk.
... View more