Answer by warren for Output of 1 query to be used a input of another to get results

I think what you’re asking is about subsearches (but it’s hard to tell from your description)

Do you mean something like this?

index=ndx1 sourcetype=srctp1 val=abc 
    [| search index=ndx2 sourcetype=src2 id=*
    | stats count by id
    | fields - count ]
| stats count by val id

from User warren – Stack Overflow https://stackoverflow.com/questions/74118480/output-of-1-query-to-be-used-a-input-of-another-to-get-results/74124349#74124349
via IFTTT