@ahhloy - The append command does not combine the results, it generates two different results and append. To combine it you need to use the stats command after append. See the last line in the answer from @richgalloway 

You can't use regex in a search command but could do this   search ... | where match(user, "^[A-L]")   which will filter only users starting with A-L  or this   search... [| makeresults | fields - _time | eval user=split("ABCDEFGHIJKL","") | mvexpand user | eval user=user."*" ]   which uses a subsearch which effectively turns the search into   search ((user=A* OR user=B* OR user=C*...))  

Hi everyone, I tried combining two REST command by using append. However it does not work. The first rest command , I would need to get info on who is the Search Head captain, and the 2nd rest command I would need to get the bundle replication file size from the search head captain to display the bundle size. Hope some one can assist. Thank you.    | rest splunk_server=local /services/shcluster/captain/info | fields Captain | rename label as Captain | append [ rest splunk_server=Captain /services/search/distributed/bundle-replication-files ] | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size

Thanks for the reply! I confirmed that there is a Trigger in the Alert Settings screen. However, this case is about setting up a Report to perform an action based on the search results. The configuration item you told me was not present in the Report Schedule Settings. After doing some research on my own, I found that the item alert.digest_mode in savedsearches.conf may correspond to this, so I will try changing this setting.

Without seeing how you assign the tokens, it's hard to say why they are not showing anything, but you have to assign the click names and values in the <drilldown> section - these will not show any value outside that, so this will never work.   <b>$$clickname$$</b>: $click.name$<br/> <b>$$clickvalue$$</b>: $click.value$<br/> <b>$$clickname2$$</b>: $click.name2$<br/> <b>$$clickvalue2$$</b>: $click.value2$<br/>    Here is a working example of a <row> that shows you how it works <row> <panel> <chart> <search> <query>index=_audit | chart count over user by action</query> <earliest>-4h@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="user">$row.user$</set> <set token="CV">$click.value$</set> <set token="CN">$click.name$</set> <set token="CV2">$click.value2$</set> <set token="CN2">$click.name2$</set> </drilldown> </chart> <html depends="$CV$"> <h2>CV=$CV$</h2> <h2>CN=$CN$</h2> <h2>CV2=$CV2$</h2> <h2>CN2=$CN2$</h2> <h2>User=$user$</h2> </html> </panel> </row>