It's because I forgot the backslash before the pipe in the rex 🙂
Corrected line (and I'll edit OP, too)
| rex field=doctime "(?<docviz>[^|]+)\|(?<when>\d+)" June 02, 2020 at 01:59PM
via reddit https://www.reddit.com/r/Splunk/comments/gt6by8/alerting_on_last_specific_action/fsnpkrv?utm_source=ifttt