I opened a case with Splunk and they reviewed and replied that all of the DB Inputs running on the SHC Captain is expected behavior.  Here's an excerpt from their findings: "In review and consultation with other colleagues I believe I may have found an answer. It is located in the documentation:  https://docs.splunk.com/Documentation/DBX/3.15.0/DeployDBX/Distributeddeployment#:~:text=by%20executing%20input/output%20on%20the%20captain   Specifically, the  Deploy DB Connect on search head clusters section. DB Connect provides high availability on Splunk Enterprise with a Search Head Cluster, by executing input/output on the captain. Essentially, this is saying that in Splunk this is normal "expected behavior" and can be treated as such."   To me this means that DB Inputs and DB Outputs on the Search Head Cluster will be limited by the hardware (CPU / Memory) of the captain, so you have to be careful with this. The benefit of DB Connect on an SHC is the replication of identity and connection configs across the cluster members.  Rather than using DB Connect to configure and run the Input/output jobs, I recommend creating scheduled searches that run the dbxquery command.  This way, the query jobs are distributed by the captain to all of the members of the cluster.  I am testing this on my SHC with positive results!

I was able to find a provenance="UI:Report" inside of index=_introspection sourcetype=search_telemetry that I think will have the data you are after. Example SPL:   index=_introspection sourcetype=search_telemetry desc.provenance="UI:Report" earliest=-90d@d latest=now | stats values(host) as hosts, latest(timestamp) as last_run_epoch by "desc.app", "desc.savedsearch_name" | eval days_since_last_run=((now()-'last_run_epoch')/(60*60*24)), duration_since_last_run=tostring((now()-'last_run_epoch'), "duration") | convert ctime(last_run_epoch) as last_run_timestamp      

I think this regex will capture just the value for template. \s+template:\s+([^,]+) The character after the carrot inside the square brackets means match on a character not in this list. And adding a "+" after is a quantifier for 1 or more times.  So doing "template: (?<TemplateID>[^-]+)" is matching on all characters after 'template: ' up until a "-" (which I dont see one in the example. So replacing the "-" with a "," I think will extract the value as intended.  

@Anees Ur.Rahman confirmed with me they used this existing post to find a solution.  https://community.appdynamics.com/t5/Controller-SaaS-On-Premises/Error-when-trying-to-create-event-service-Connection-Refused/m-p/50833