https://community.splunk.com/t5/Knowledge-Management/Splunk-Security-Essentials-Unmatched-paranthesis-in-Domain/m-p/570831#M8534 <P>If you have an entitlement, please file a support request to report that bug.</P> Wed, 13 Oct 2021 17:54:08 GMT richgalloway 2021-10-13T17:54:08Z https://community.splunk.com/t5/Knowledge-Management/Splunk-Security-Essentials-Unmatched-paranthesis-in-Domain/m-p/570802#M8533 <P>In the latest Splunk Security Essentials 3.4.0, and previous release the Data Inventory detection in CIM+Event Size Introspection starts a query that will never complete due to an unmatched paranthesis.&nbsp;&nbsp;&nbsp; The query is autogenerated, so I'm not sure if this is due to a misconfiguration on my part, or perhaps just a unwanted feature.</P><P>&nbsp;</P><P>(index=main source=WinEventLog:Security) ) OR (index=main source=WinEventLog:Security ) | head 10000 | eval SSELENGTH = len(_raw) | eventstats range(_time) as SSETIMERANGE | fields SSELENGTH SSETIMERANGE tag | fieldsummary</P> Wed, 13 Oct 2021 16:01:57 GMT https://community.splunk.com/t5/Knowledge-Management/Splunk-Security-Essentials-Unmatched-paranthesis-in-Domain/m-p/570802#M8533 bseppanen1 2021-10-13T16:01:57Z https://community.splunk.com/t5/Knowledge-Management/Splunk-Security-Essentials-Unmatched-paranthesis-in-Domain/m-p/570831#M8534 <P>If you have an entitlement, please file a support request to report that bug.</P> Wed, 13 Oct 2021 17:54:08 GMT https://community.splunk.com/t5/Knowledge-Management/Splunk-Security-Essentials-Unmatched-paranthesis-in-Domain/m-p/570831#M8534 richgalloway 2021-10-13T17:54:08Z