I need to find whether the string ["foobar"] exists in a log message.  I have a search query like some stuff | eval hasFoobar = case(_raw LIKE "%\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar which gives YESes as expected. If I add a square bracket, whether escaped or not, I only get NOes.  E.g., some stuff | eval hasFoobar = case(_raw LIKE "%[\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar some stuff | eval hasFoobar = case(_raw LIKE "%\[\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar   Any advice?   ... View more

We're investigating Splunk as a logging solution. We've got the Cloud Trial and we're trying to test the REST API. We've been at it for some time, but I haven't been able to find a way to get it to work, because there's always an authentication challenge. Is this the expected behavior? We can't use the API without a full license? Thanks Paul ... View more