How to exclude search results based on conditions?

[alex4]

I have a below Splunk query which gives me the result.

My SPL searches the " eventType IN (security.threat.detected, security.internal.threat.detected) " and provides me the result src_ip results.

But the same src_ip field has multiple user_id results in other eventType. 

I want my SPL to search the src_ip results with other eventType and filter if the user_id="*idp*".

Example - If my src_ip=73.09.52.00, then the src_ip should search the other available eventType and filter the result if the user_id=*idp*

My Current SPL

index=appsrv_test sourcetype="OktaIM2:log" eventType IN (security.threat.detected, security.internal.threat.detected) 
| rex field=debugContext.debugData.url "\S+username\=(?<idp_accountname>\S+idp-references)"
| search NOT idp_accountname IN (*idp-references*)
| regex src_ip!="47.37.\d{1,3}.\d{1,3}"
| rename  actor.alternateId as user_id, target{}.displayName as user, client.device as dvc, client.userAgent.rawUserAgent as http_user_agent, client.geographicalContext.city as src_city client.geographicalContext.state as src_state client.geographicalContext.country as src_country, displayMessage as threat_description
| strcat "Outcome Reason: " outcome.reason ", Outcome Result: " outcome.result details
| stats values(src_ip) as src_ip count by _time signature threat_description eventType dvc src_city src_state src_country http_user_agent details 
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_threat_detected_filter`

[PickleRick]

You're omitting the important part - the "other eventtype search".

[alex4]

@PickleRick There are multiple eventTyes in my logs. If i include all eventType then I am getting lot of results. Pls assist.

[yuanliu]

What @PickleRick is trying to say is that you should tell volunteers what "other eventTypes" mean, how their data look like.  I'd like to add

Example - If my src_ip=73.09.52.00, then the src_ip should search the other available eventType and filter the result if the user_id=*idp*

---

What does "filter the result" mean?  In many contexts, this phrase is commonly used to mean "to exclude results satisfying such and such."  But in your case, I have a suspicion that you mean the exact opposite.

In addition to this question, you also fail to tell volunteers which data do you expect to include AFTER "filter the result"?  Are you interested only in fields from "other eventTypes"?  Only in fields from eventTypes security.threat.detected and security.internal.threat.detected?  Or some fields from eventTypes security.threat.detected and security.internal.threat.detected, some fields from "other eventTypes"?  Which ones?

When you ask a question in a user forum, you need to give all and precise relevant information in terms of data, desired results, and the logic between data and desired logic, and not make volunteers take wild guesses.