I've observed some strange behavior with a particular search: index=test NOT user=*$ Will not return results where user does not end with $ (in my test data there are no users that end with $) This search however, works just fine and returns results. index=test user!=*$ I've tested against other indexes and discovered that this problem only presents itself when the "user" field is based upon a calculated/eval based extraction. Some might ask, why not just use the latter search if it works? The reason is because the "Authentication" data model used by ES includes such a filter (i.e. tag=authentication NOT (action="success" user=*$) and I do not want to change the data model unless I absolutely have to. I appreciate any feedback the Splunk community can offer! ... View more

Is there any way to view actual contents of a threatlist via REST? I've found references to: | rest /services/data/threatliststats and | rest /services/data/inputs/threatlist But these objects only show metadata about the threatlist. How do I get actual contents? The reason I need to do this is because my threatlist type is custom (i.e. not "threatlist" or "threatlist_domain") which means that the contents do not actually get put in the normal threatlist lookup tables such as threatlist_lookup_by_domain_or_url or threatlist_lookup_by_str. Thanks in advance for the help! ... View more