We have multiple TraceIDs that have same payload and this payload is part many logs for a given TraceID. Here foo1 is a common payload for multiple TraceIDs 1, 3, 4. Is it possible to search for all unique traceIDs 1, 2 only based on the payload, then get all of the logs for these traces? Input: TraceID Type             Name        Payload 1               HEADER     first            foo1 2               HEADER     first            foo2 3               HEADER     first            foo1 4               HEADER     first            foo1 Output: TraceID Type             Name        Payload 1               HEADER     first            foo1 2               HEADER     first            foo2 You can get unique traceIds grouped by Payload using stats max(traceId) as maxTraceId, min(traceId) as minTraceId by payload Now, how do we feed the maxTraceId into another search? We need all of the logs for these TraceID 1, 2 only. These requests did not work. some_search [ search some_search | stats max(traceId) as maxTraceId by payload | fields maxTraceId ] some_search [ search some_search | streamstats max(traceId) as maxTraceId bypayload | fields maxTraceId ] some_search | where traceId IN [ search some_search | stats max(traceId) as maxtraceId by paload | fields maxtraceId ] TraceID Type             Name        Payload 1               HEADER     first            foo1 1               BODY           second     bar1 1               FOOTER      third           baz1 2               HEADER     first            foo2 2               BODY           second     bar2 2               FOOTER      third           baz2 ... View more