Splunk join two query to based on result of first query

Question

In Splunk query I have two query like below

Query 1- index=mysearchstring1 Result - employid =123

Query 2- index=mysearchstring2

Here I want to use employid=123 in my query 2 to lookup and return final result.

Is it possible in Splunk?

Answer 1

It sounds like you're looking for a subsearch.

index=mysearchstring2 [ search index=mysearchstring1 | fields employid | format ]

Splunk will run the subsearch first and extract only the employid field. The results will be formatted into something like (employid=123 OR employid=456 OR ...) and that string will be appended to the main search before it runs.