Subquery to get rows

[Ravman]

Hi
What is the syntax using subquery to get all rows having the same correlation id that of an inbound call with a given account t id.

basically Get all rows where correlationId = ( correlationId where acct id = myAcctId)

[Ayn]

[search <some search that gets relevant events> acctid=yourAcctId | dedup correlationId | fields correlationId]

This will expand into a list looking something like

((correlationId = "someid") OR (correlationId = "someotherid") OR (...) ... )

Where the ID's in the list are, of course, the ones found in the subsearch that looked for the correlation ID's related to your account.