Answer by warren for Search using previous query’s values

You certainly can sequentially build a search like this, but you’re likely better off doing it this way:

index=ndx sourcetype=srctp someField IN("my","list","of","values") "string_value"
| stats values(someField) as someField

The more you can put in your initial search, the better (in general)

from User warren – Stack Overflow https://stackoverflow.com/questions/75454910/search-using-previous-querys-values/75460544#75460544
via IFTTT