Please check my answer on your repost : https://answers.splunk.com/answers/701762/repost-please-can-anyone-help-help-search-depends.html?childToView=702919#answer-702919 Cheers, David ... View more

join has worked, below is the query. index="A" |join type=inner inc_number [search index= "B"] |dedup inc_number |table inc_number,SLA ... View more

In the Splunk App for Stream, i.e. not the TA, access the Configuration->Configure Streams menu item from the navigation bar. Scroll down until you find the stream titled "netflow" and choose "edit". Then, in the resulting config screen, ensure that the Mode is set to "enabled". This will enable the stream as described above by @seg42 ... View more