I'm attempting to build a search around Okta authentication logs.  I want to run a query to check for any Multi factor update/change, collect the user ID and pass that to another search where I see the geolocation data where the User has authenticated previously over a specific time span.  Essentially, I'm trying to build a search to see if a user that requested an MFA change is doing it from a different geolocation than they normally authenticate from. The query below shows all users that have have a MFA change with their corresponding geolocation data.  Is there a way to pass the user ID(s) to a different search where I can look at 7 days worth of their authentication activity to see if the geolocation matches?  I've researched sub-searches but that doesn't work because I need the user ID first but the subsearch runs first and I don't have the user ID yet.  I looked at map which seems like it's the best solution, but there a lot of warnings about it being resource intensive.  If anyone can point me in the right direction, it would be very much appreciated.     index=okta eventType="user.mfa.factor.update" | stats values(actor.id), values(client.geographicalContext.State)       ... View more