@VatsalJagani thank you for the advise.. Not sure if the use of stats command is correct. I would need the append output to show the search head captain, bundle size and file name.  | rest /services/shcluster/status splunk_server=local | fields captain.label | append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files | fields captain.label size filename | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size ] | rest /services/shcluster/status splunk_server=local | fields captain.label | append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files | fields captain.label size filename | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size ] | stats latest(_time) as latest_time by captain.label size filename | convert ctime(latest_time) ... View more

Hi everyone, I tried combining two REST command by using append. However it does not work. The first rest command , I would need to get info on who is the Search Head captain, and the 2nd rest command I would need to get the bundle replication file size from the search head captain to display the bundle size. Hope some one can assist. Thank you.    | rest splunk_server=local /services/shcluster/captain/info | fields Captain | rename label as Captain | append [ rest splunk_server=Captain /services/search/distributed/bundle-replication-files ] | eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S") | eval size=size/1024/1024/1024 | table filename timestamp size ... View more