How to search a query based on the result of another query?

[krishman23]

I have list of events that have IP address

{
USERID: system01
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system03
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system02
browser: Chrome,
ip: 192.168.11.10
...}
I want to get the events that has the number of ip only once
the output should only be
{
USERID: system01
browser: Chrome,
ip: 192.168.11.10
...}
as 192.168.10.10 is repeated twice it should be eliminated.

[pradeepkumarg · Accepted solution]

If you have IP address extracted into a field, let's say IP. You can append following to your search.

|eventstats count by IP | search count < 2