How to input the value of key from the second search result in the "in" clause of "where" of the first search?

[sramya]

HI
I want to write a query like this

index=* "searchString1" | where in ([search "searchString2" | field key]) 

It may be incorrect syntax but let me explain that:

suppose the "index=* "searchString1" returns

"it is good abc"
"it is good def"
"it is good you"

and the "index=* "searchString2" returns

"I am bad key=abc"
"i am fine key=def"
"I am better key= fat"

Now my goal is to input the value of key from the second search result in the "in" clause of "where" of the first search so the output of looks like this.

"it is good abc"
"it is good def"

Is it possible is splunk?
It is kind of a nested sql query.
I am quite new to splunk so need some help.

Saurabh

[somesoni2 · Accepted solution]

Give this a try

index=* "searchString1" | where [search index=* "searchString2" | stats count by key | table key]

[xpac]

Wouldn't it actually be easier like this?

index=* "searchString1" [index=* "searchString2" | stats count by key | fields key]