I figured it out. index=(\"|)(?P<user_index>[^ "]+)   ... View more

Try this REST search. | rest /services/search/jobs/<<SID>>   ... View more

hi @hank72, No, it should not restart Splunk on existing clients. From Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/Updating/Updateconfigurations#When_editing_serverclass.conf_directly After you run reload deploy-server , the deployment server deploys  all  server classes. That is if any app in any server-class is new or has changed since it was last deployed, the deployment server deploys the latest version to the qualifying clients for that server class.  If this reply helps you, a like would be appreciated. P.S. You don't need to run splunk reload deploy-server command if you are adding new client using forwarder management.     ... View more