title: how do i pass a result from one search into IN clause of another search in splunk?
body: <p>i run a query and get list of custId in form of table. how do i pass this result into another search query inside IN clause. </p>
  
  <p>eg:</p>
  
  <p>search 1: index=* "successful login for"|table custID
   this gives me table with column custID.</p>
  
  <p>Then i have to run</p>
  
  <p>index=* "mail sent by"|where custID IN (search 1) |table CustID,_time</p>