@VatsalJagani thank you for the advise.. Not sure if the use of stats command is correct. I would need the append output to show the search head captain, bundle size and file name. | rest /services/shcluster/status splunk_server=local | fields captain.label | append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files | fields captain.label size filename | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size ] | rest /services/shcluster/status splunk_server=local | fields captain.label | append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files | fields captain.label size filename | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size ] | stats latest(_time) as latest_time by captain.label size filename | convert ctime(latest_time)
... View more
