Using two lookup tables in one query

[bp32795]

I am trying to create an alert that will utilize a search with data from two lookups. Basically, I want to:

1. Take/return an account number from a specified field in lookup1
2. Search lookup2 for all rows with the account number from lookup1, and return matching values from the userid field where the account number matches from that lookup where the account number matches
3. Take those userids and insert them into a regular search. 

I can do step 3 with the following query, but I am unsure how to manage 1 and 2. Has anyone done something similar?

index=logins [| inputlookup manual_id_list.csv | return 3000 $UserID]
| search NOT [search index=logins[| inputlookup manual_id_list.csv | return 3000 $UserID ] logMessage = "user reset passwordt" |fields user_full_name | format ]
| top limit=300 user_full_name
|table user_full_name

[tscroggins]

@bp32795 

You can nest subsearches, rename fields, etc. when using inputlookup:

[ | inputlookup lookup2 where [ | inputlookup lookup1 | rename UserId as AccountNumber | return AccountName ] | return UserId ]

=>

[ | inputlookup lookup2 where (AccoutNumber="123" OR AccountNumber="456") | return UserId ]

=>

(UserId="ima.sample" OR UserId="john.doe")