HI Anantha,
Thank you for the response,
yes, that is the query I am using. Assume I am using the query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total" When I want to triage the "Total" events and click on the "Total" in Splunk, instead of displaying the events, it is taking me to the same query in another tab. the "Total" field does not provide the total events instead it is taking me to the same query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total."
... View more