Adjusting quotes from subquery using format

[alancalvitti]

I'd like to (1) use a subquery to extract a list of deviceId's then (2) search the same index for all events containing any of those devices returned by the subquery.

However, format puts quotes around each deviceId value only: deviceId="abc123" rather than around the equal sign: "deviceId=abc123" .

Consequently the outer search doesn't match any events, while the latter modified form does. Is there an option for format to adjust quotes accordingly? Concrete example (1)

index=myIndex DeviceLog | rex "(?i)deviceId=(?P<DevId>[^ ]+)" | stats values(DevId) as deviceId | format

returns a list of the form:

( ( ( deviceId="0002ac61d" OR deviceId="0003511e" ... OR deviceId="0006ecff" ) ) )

But the query/subquery combination doesn't match any events:

index=myIndex DeviceLog [search index=myIndex DeviceLog | rex "(?i)deviceId=(?P<DevId>[^ ]+)" | stats values(DevId) as deviceId | format]

I've also tried a subquery variation using return like this:

...| dedup DevId | return 100000 $DevId]

this almost works because it matches the deviceId values but doesn't match the key prefix deviceId= which can result in false positives (cookies caching device id's in different parts of the device log)

[to4kawa]

index=myIndex DeviceLog "deviceId="

Is this the same result?

[alancalvitti]

@to4kawa, can you be more specific as to where "deviceId=" in your answer should go? I tried it in the outer query like this index=myIndex DeviceLog "deviceId=" [search index=myIndex DeviceLog | rex ... but got zero matches.

[alancalvitti]

I see now it works with the last variation using return statement, thanks.

[jacobpevans]

Don't forget to mark the answer if it helped you resolve your problem for others in the future.