Hi, I'd use SEDCMD in props.conf. You can find more details in the props.conf.spec. This is used for anonymization, but it should also work for your use case. If you want detailed steps to set it up, you can follow this guide: Anonymize data with a sed script. smurf ... View more

Hi @Alejandro1195, as I said, there are many parameters to answer to your question that I listed in my previous post. in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc... You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches. this means that if you optimize your dashboard, you should have 100 searching users in the same time. My hint is to monitor your installation. At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods. If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes. Ciao. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more