Hi @vadlamudi, I think "Field for Label" and/or "Field for Value" settings are not SERVER_TYPE. Please update them as SERVER_TYPE like below.   ... View more

Why did you accept the answer if it doesn't work? The dashboard code in the answer is not complete.  The snippets provided need to be inserted into the proper places in your XML. ... View more

From your description it looks like your k8s_label is a field containing 4 lines of data, each line represents a field of its own. However, your where statement in your first query references 'id=<xxx>" where there is no id= component in that text. What do you want as your final output? However, in terms of using one query to filter another you can use a subsearch, e.g. index=<index_name> "server failed" [ search index=<index_name> sourcetype=<sourcetype_name> | rex field=k8s_label "(?s)project_id=(?<Project_id>\d+)" | fields Project_id ]  which will use the Project_id from the subsearch as a filter to the outer search for server failed, but I am not clear if this is what you need. Can you clarify your data and expected output.   ... View more

You can add the extractions from the GUI (the settings you add there land in the props.conf and transforms.conf of the search app). But in search time... Try this: | rex max_match=0 "k8s_label\s*=\s*(?<myprefix>[^=]+)=(?<mysuffix>\S+)" | eval myvars=mvzip(myprefix,mysuffix) | mvexpand myvars | rex field=myvars "(?<mykey>[^,]+),(?<myvalue>.*)" | eval {mykey}=myvalue | fields - mykey myvalue myprefix mysuffix myvars | stats values(*) by _raw _time | foreach values(*) [ rename <<FIELD>> as <<MATCHSTR>> ] Ugly like hell but might just work 😉 ... View more

I believe there's already a question about this. But try this... $SPLUNK_HOME/bin/splunk cmd openssl s_client -connect <hostname>:<management-port> ... View more

Thank you for the reply. But i would like to know what would the good value for User-level concurrent search jobs limit . ... View more

Check this, https://answers.splunk.com/answers/494555/is-there-any-way-to-list-all-the-saved-searches-in-1.html#answer-494559 check the below query | rest /services/saved/searches | where is_scheduled=1 for historical scheduled searches use the below query, index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count * ... View more