Is there a way to edit the output given by sub search?

[Callum_f]

I have a sub query that gives the output example below 

Sub Query

 [ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") 
| fields error.requestId 
| rename error.requestId as requestId 
| dedup requestId 
| format ]

Output

( requestId="jjadjdfjjedd_jehdfjdjfhj" ) OR ( requestId="jgjfnfdn_jrhfjdbfd" )....

I need to edit the format that is returned from the first query. 

Is there a way to change the search to something less specific? Such as

(*jjadjdfjjedd_jehdfjdjfhj*) OR (*jgjfnfdn_jrhfjdbfd*) .....

As I need to find all events that include the requestId, not just when it is specific to that variable.

[ITWhisperer · Accepted solution]

Try like this

 [ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") 
| fields error.requestId 
| rename error.requestId as query
| dedup query
| format ]

The query field is treated differently

[Callum_f]

@ITWhisperer It works thank you very much 🙂

I need to search over the last 30 days but it seems to crash with a time of over 24 hours. Is there a way to break the search up so it can run as the sub search is giving a large number of values that are then searched on. 

[ITWhisperer]

You could try this

 [ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") earliest=-1d@d latest=@d
| fields error.requestId 
| rename error.requestId as query
| dedup query
| format ] OR
 [ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") earliest=-2d@d latest=-1d@d
| fields error.requestId 
| rename error.requestId as query
| dedup query
| format ] OR
 [ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") earliest=-3d@d latest=-2d@d
| fields error.requestId 
| rename error.requestId as query
| dedup query
| format ]
etc.

Or perhaps you need to approach it a different way to eliminate the subsearch or make your 30 day search the main search and your other search the subsearch