Hi, I want to extract the following term from this message:   (MaRSEPbac, [MaRSEPbac_Old2], [MaRSEPbac]) that means the string between ().. message: 16:21:32.843 [gcp-pubsub-subscriber1] INFO  zbank.harissa.cockpit.InboundGateway - update: [export_service] context:RDB (MaRSEPbac, [MaRSEPbac_Old2], [MaRSEPbac]) progress:3/3 status:successful msg:exporting rrid: [8d9a85b8-0d34-4dea-8901-17520b4b9b9d] rrid:f50a0cce-af13-4e64-88aa-84de045380ca How does it goes? Thanks!

Hi, so I have a Bargraph with many values. The enduser who has to use that bargraph needs to see if the values are over or under certain values at some point. Thats why I want to draw a line at both the max allowed value and the min needed value. I attached a picture of how I want it to look. Is it possible to achieve something like this?

Hi all, I keep getting "DateParserVerbose [6827 merging] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (75) characters of event. Defaulting to timestamp of previous event" warnings. The time stamp in the logs looks like: 2021/10/28T16:06:08.183-07:00 props.conf looks like: DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = true MAX_TIMESTAMP_LOOKAHEAD = 75 MAX_DAYS_AGO = 36500 MAX_DAYS_HENCE = 36500 TIME_FORMAT = %d-%b-%y %I.%M.%S.%6Q %p SHOULD_LINEMERGE = false TRUNCATE = 500000 Anyone know what my time_format should be instead?

Greetings,   I'm looking to craft a correlation that allows me to compare the results between two separate searches. Here's the use case: I have 2 indexes, one containing Threat Intelligence data (including domain names to be specific for this case). While the other index holds all DNS requests. I'm looking to craft a Splunk correlation that reads each domain within the DNS requests, which then compares each of those domains to the Threat Intelligence data and see if there's any matches.    For instance, maybe something along the lines of the logic below: index=Threat_Intelligence | table DomainName | where DomainName IN [search index=DNS | table RequestedDomain]   FYI: The latest Threat Intelligence feeds are pulled every single morning and is updated within Splunk. I thought about using lookup tables or KV Store lookups, but we're pulling in several files each morning, 2 of which are close to 1GB in size. It looks like Splunk Cloud caps the event limit of these lookups to 10,000 events by default, and I've read to be cautious about increasing this limit. 

Oct 28 20:08:57 XXX.XXX.com Microsoft-Windows-Security-Auditing[4]: EventID: 4663 An attempt was made to access an object. Subject: Security ID: XXX Account Name: John Account Domain: XXX    My question is how do I extract the "Account Name: user" from this? I tried creating a new field extract with the space delimiter but if I selected John above, it wouldn't pull the account name from the rest of the log entries. Thanks in advance!