I am fairly new to Splunk and only have the basics under my belt at best. I'm having trouble proving out the following use case:  Taking a malicious URL (threatURL) from email threat (index=emailThreat) events and then querying the firewall (index=firewall) for any user activity including the referenced malicious URL. So far I have the following search: index=firewall log_subtype=url [search index=emailThreat | dedup threatUrl | table threatUrl] | table time, url, user Separately, the the two searches work and return the expected value. However, when put together, the search returns no results. Not sure what I'm missing. ... View more