Splunk nested query

[smorla]

index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(REQUESTED)*")
|stats latest(_time) as start_time by cwmessage.transId
|join cwmessage.transId
[search index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(COMPLETED)*")
|stats latest(_time) as cdx_time by cwmessage.transId ]
[search index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(UPDATeD)*")
|stats latest(_time) as upd_time by cwmessage.transId ]
|join cwmessage.transId
|eval cdx=cdx_time-start_time, upd=upd_time-cdx_time
|table cwmessage.transId, cdx,upd

From above query I'm using index query in multiple times, i want to use it as base search and call that in all nested searches for the dashboard. Please help me.
Thanks

[richgalloway]

Are you trying to reduce the number of joins in the query (a good goal) or use this query in multiple dashboard panels (or maybe both)?

[ITWhisperer]

Try something like this

index="abc" aws_appcode="123" logGroup="watch" region="us-east-1" (cwmessage.message = "*Notification(REQUESTED)*") OR (cwmessage.message = "*Notification(COMPLETED)*") OR (cwmessage.message = "*Notification(UPDATED)*")
| stats latest(eval(if(match('cwmessage.message',".*Notification\(REQUESTED\).*"),_time,null()))) as start_time latest(eval(if(match('cwmessage.message',".*Notification\(COMPLETED\).*"),_time,null()))) as cdx_time latest(eval(if(match('cwmessage.message',".*Notification\(UPDATED\).*"),_time,null()))) as upd_time by cwmessage.transId
| eval cdx=cdx_time-start_time, upd=upd_time-cdx_time
| table cwmessage.transId, cdx,upd

[smorla]

Okay will try. Thanks.