For others to construct a search, they will need to know which field in index zscaler can be matched with userID - I'll assume the same field name; which field in index zscaler represents user's E-mail - I'll assume the name userEmail, they will also need to know which field in index exomsgtrace represents outbound E-mail - I'll assume something like outgoingEmail, as well as further assume that's a multivalue; as well as how you want the result presented; in addition, what other characteristics are in zscaler and exomsgtrace because different characteristics can require very different search approaches. (These details should be described in the question and not leaving it to volunteers to speculate.) For simplicity, I'll assume that there's no overlapping fields between the two indices, and userID, outgoingEmail are already extracted, and that you wanted a list of timestamps (_time), senders (sender), and subject (subject) in exomsgtrace when outgointEmail contains E-mail address of a matching userID, all of these fields already available in the index.
Using these assumptions, what I assumed you wanted can be done with something like
index=exomsgtrace OR (index=zscaler
[| inputlookup leavers.csv
| fields userID] ``` assume userID also exists in zscaler ```)
| mvexpand outgoingEmail ``` outgoing Email could be multivalued ```
| eval userEmail = coalesce(userEmail, outgoingEmail) ``` use the same field name ```
| eval _time = if(index == zscaler, null(), _time)
| stats values(_time) as _time values(sender) as sender values(subject) as subject by userEmail
