topic Two level query in Reporting

Two level query

nevillehere — Mon, 28 Sep 2020 14:01:30 GMT

I'm new to Splunk and would like to know if there's a way to create a two level query such as this one below:

SELECT * FROM some_logtype WHERE ID IN (
SELECT distinct KnownID FROM some_logtype WHERE someCondition
)

kml_uvce — Sun, 02 Jun 2013 12:55:54 GMT

sourcetype=secondlogtype |join ID [search sourcetype=secondlogtype]

You can use index name instead of sourcetype if sourctypes are same and index are differnt.