How do I merge the below 2 complex queries? Let me know if it's possible in Splunk? Search 1: -      index=ABC (eventtype=X OR eventtype=Y) log_subtype=DEF field_A="*SQL*" | stats values(A) as A values(B) as B values(C) as C BY X, Y | where B > 2 | search NOT [|inputlookup test_1.csv | fields X ] | search NOT [|inputlookup test_2.csv | fields X ] | eval name="search_1"       Search 2: -     index=ABC (log_subtype="GHI" OR log_subtype="JKL") (severity="medium" OR severity="high" OR severity="critical") action=* NOT (field_B="Unknown(5000007)" AND action="blocked") NOT dest_ip="11.22.33.44" | stats values(D) as D values(E) as E values(A) as A BY X, Y | eval name="search_2"       I succeeded on merging the 2 searches up to some extent (up to stats command)     index=ABC (log_subtype="DEF" OR log_subtype="GHI" OR log_subtype="JKL")(((eventtype=X OR eventtype=Y) field_A="*SQL*") OR ((severity="medium" OR severity="high" OR severity="critical") action=* NOT (field_B="Unknown(5000007)" AND action="blocked") NOT dest_ip="11.22.33.44" )) | stats values(A) as A values(B) as B values(C) as C values(D) as D BY X, Y       I am not sure on how I can apply where condition and exclusion lookups from search 1 while combining as they are specific to search 1 and do not want to apply those to search 2?             ... View more