Pass the result of one query to another

[anjihari]

I have the first query

First Query :     search criteria | rex field=_raw ".* IPAddress=(?<IPAddress>.+?) " | table IPAddress

The above query is returning a table with all IPAddress. I want this data to be looked at in the second query. How can we write two queries as single?

Second Query :   search criteria  | rex field=_raw ".* IPAddress=(?<IPAddress>.+?)\"" | where IPAddress in (first Query results )  | rex field=_raw ".* value=(?<value>.+?)\"" | table IPAddress,value, _time

I tried below but it is empty results

<first search > | rex field=_raw ".* IPAddress=(?<IPAddress>.+?)\"" | where IPAddress in ([search <second search> | rex field=_raw ".* IPAddress=(?<IPAddress>.+?) "
| fields IPAddress ])| rex field=_raw ".* value=(?<value>.+?)\"" | table IPAddress,value, _time

[richgalloway]

There is no "passing" of results in a query, except via pipe.  You may be able to get a subsearch (like you already tried) to work, but we'd need to see the "search criteria" as that has a big effect on how the searches are combined.