There is no "passing" of results in a query, except via pipe.  You may be able to get a subsearch (like you already tried) to work, but we'd need to see the "search criteria" as that has a big effect on how the searches are combined.   ... View more

| makeresults | eval data="Feb 18 23:25:49 ip-x-x-x-x customerService 2020-02-18T23:25:49.340Z level=INFO component=customerServiceresource message=\"Request {\"customerDetails\":{\"customerName\":\"Jack\",\"bank\":\"xxx\",\"action\":\"decline\"}}|Feb 18 23:25:49 ip-x-x-x-x customerService 2020-02-18T23:25:49.340Z level=INFO component=customerServiceresource message=\"Request {\"customerDetails\":{\"customerName\":\"mike\",\"bank\":\"xxx\",\"action\":\"approve\"}}|Feb 18 23:25:49 ip-x-x-x-x customerService 2020-02-18T23:25:49.340Z level=INFO component=customerServiceresource message=\"Request {\"customerDetails\":{\"customerName\":\"holden\",\"bank\":\"yyy\",\"action\":\"approve\"}}|Feb 18 23:25:49 ip-x-x-x-x customerService 2020-02-18T23:25:49.340Z level=INFO component=customerServiceresource message=\"Request {\"customerDetails\":{\"customerName\":\"leslie\",\"bank\":\"yyy\",\"action\":\"decline\"}}", data=split(data,"|") | mvexpand data | eval _raw=data | rex "(?<json>{.*)" | spath input=json | stats count(eval('customerDetails.bank'="xxx" AND 'customerDetails.action'="approve")) as ans1 ,count(eval('customerDetails.bank'="yyy" AND 'customerDetails.action'="decline")) as ans2 ,values(eval(if('customerDetails.bank'="yyy" AND 'customerDetails.action'="decline",_raw,null()))) as ans3 ... View more