Using output of nested pipelines in expressions

[mavam]

A user provided the following scenario:

export
  | where timestamp > 1 hour ago && #schema == "suricata.flow" 
  | summarize received_bytes=sum(flow.bytes_toclient) by src_ip
  | sort received_bytes desc
  | rename endpoints_with_alot_traffic=src_ip | put endpoints_with_alot_traffic
  | head 3

This yields the following 3 IP addresses:

Then they'd like to use these addresses in an expression:

export
  | where timestamp > 1 hour ago && (242.190.23.132 || 75.116.79.28 || 75.116.199.133)
  | summarize count=count(event_type) by src_ip, event_type

With the final desired outcome to be this (screenshot from app.tenzir.com/explorer):