Hi
What is the syntax using subquery to get all rows having the same correlation id that of an inbound call with a given account t id.
basically Get all rows where correlationId = ( correlationId where acct id = myAcctId)
[search <some search that gets relevant events> acctid=yourAcctId | dedup correlationId | fields correlationId]
This will expand into a list looking something like
((correlationId = "someid") OR (correlationId = "someotherid") OR (...) ... )
Where the ID's in the list are, of course, the ones found in the subsearch that looked for the correlation ID's related to your account.