All Apps and Add-ons

error on drilldown for "max concurrent searches" check

Motivator

When I click the drilldown for the max concurrent searches I get the following error page:

SearchException: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[ search earliest=1 index=internal sourcetype="splunkd" loglevel="INFO" component="loader" detected | rex "(?i)Detected (?P[^ ]+)" | rename cores as search | fields - * | stats first(search) as search by splunkserver | stats sum(search) as search ]'.

0 Karma

Motivator

Try this search

index=internal sourcetype="splunkd" loglevel="INFO" component="Metrics" group="searchconcurrency" "system total"| timechart span=1m sum(activehistsearches) sum(activerealtime_searches)

make it a line graph to see how your doing over time

0 Karma

Builder

Since the copied text is a subsearch, can you check and see if the full search is listed on the jobs page? If it's not, can you post the full search from the audit.log ([$SPLUNK_HOME]/var/log/splunk/)

0 Karma