error on drilldown for "max concurrent searches" check

[mikelanghorst]

When I click the drilldown for the max concurrent searches I get the following error page:

SearchException: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[ search earliest=1 index=_internal sourcetype="splunkd" log_level="INFO" component="loader" detected | rex "(?i)Detected (?P[^ ]+)" | rename cores as search | fields - _* | stats first(search) as search by splunk_server | stats sum(search) as search ]'.

[hartfoml]

Try this search

index=_internal sourcetype="splunkd" log_level="INFO" component="Metrics" group="search_concurrency" "system total"| timechart span=1m sum(active_hist_searches) sum(active_realtime_searches)

make it a line graph to see how your doing over time

[bbingham]

Since the copied text is a subsearch, can you check and see if the full search is listed on the jobs page? If it's not, can you post the full search from the audit.log ([$SPLUNK_HOME]/var/log/splunk/)