Filter result with another search

[rxalex]

Hi Folks, I have been trying to pull some data associated with latest Run ID (associated with execution), I am having hard time writing query for it. Any help would be appreciated.

Base Data:

index="unified-tests" dataType="TestRail"

To this I would need to apply a filter for runId = result of below query

index="unified-tests" dataType="TestRail" | stats last(runId) as latestRunID by brand, platform | stats last(latestRunID) by latestRunID | table latestRunID

These are some failed attempts:

index="unified-tests" dataType="TestRail" runId=*[search index="unified-tests" dataType="TestRail" | stats last(runId) as latestRunID by brand, platform | stats last(latestRunID) by latestRunID | table latestRunID]

index="unified-tests" dataType="TestRail" | join left=L right=R where L.runID = R.latestRunID [search index="unified-tests" dataType="TestRail" | stats last(runId) as latestRunID by brand, platform | stats last(latestRunID) by latestRunID | table latestRunID]

[ITWhisperer · Accepted solution]

Try something like this

index="unified-tests" dataType="TestRail" [search index="unified-tests" dataType="TestRail" | stats last(runId) as runId by brand, platform | fields runId]

[rxalex]

Thanks a lot @ITWhisperer suggested solution worked