Checking your regex on regex101 shows that it fails – you’re looking to match a literal ", but it’s not there for your "null" value
This regular expression is both simpler to read, and pulls what you’re looking for (without the extraneous comma):
| rex field=Message "TimesAccessed[[:punct:]]+(?<TimesAccessed>[^\",]+)"
Use the [[:punct:]] character class to match any punctuation between the text you’re trying to match
from User warren – Stack Overflow https://stackoverflow.com/questions/73122992/splunk-rex-search-unable-to-tabulate-because-of-null/73126979#73126979
via IFTTT