You can also use subsearch in combination with variable expansion.
For example:
IOC (dsthost:$exec_pc)
For this query, search first resolves the subsearch expression by doing a search for all the dsthosts that match the list $exec_pc and returns the result to add them as search terms in the main query. If the exec_pc list contains the hostnames execcto and execcfo, the following search is executed by the main query:
IOC dsthost:"execcto" OR IOC dsthost:"execcfo"