How to whitelist through subsearching with out lookups?

[Henesys]

So there's ton of documentations of whitelisting through the subsearch approach using lookups, however, is it possible to whitelist using another search criteria within a search?

For example...

| search 1 index=blah1

[ sub search 2 index=blah2 ]

| if user in search 2 is in 1, whitelist

Remember, I know how to whitelist through lookups. Just curious to know if there is another way.

[ITWhisperer]

| search 1 index=blah1

[ sub search 2 index=blah2 | dedup user | table user]

[Henesys]

Not quite what I'm looking for. That would just simply output a table with user regardless if user from search 2 was in search 1.

Is there anyway to make it so it can correlate or match and provide a new field saying matched between the two searches?

[ITWhisperer]

I am not sure I understand - the subsearch with dedup and table essentially produces a list of users found in the subsearch e.g. ((user=="user1") OR (user=="user2")), which is added to the end of the initial search, thereby whitelisting the users from the main search. Is this not what you want to do?

(This is similar to

search ... [| inputlookup lookupfile.csv | dedup user | table user]

which you may have seen elsewhere.)