Subquery - How can I modify format with multiple conditions?

[emilep]

Hello,

The default format of my subsearch result looks like:

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

I would like to modify subsearch format result like:

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

Do you think it is possible?

Regards,
Emile

[PickleRick]

The format command is called either explicitly or implicitly at the end of the subsearch unless you return a field called "search". If your subsearch returns a "search" field, that value is directly substituted into the outer search.

So as long as you can manually craft such search string in your subsearch you can do it. The format command just makes it easy to handle typical case.

[emilep]

As it exist some priority between AND and OR, it is right that the supplementary parentheses have no sense.
To solve my problem i used the command replace like this:

...|format|eval search = replace(search, "AND mid=", "OR mid=")

It is not perfect but it is working for now ...
Thanks for your help.

[yuanliu]

Do you realize that by doing so, you are changing semantics of the original subsearch?

Output of replace	Equivalent of original subsearch
(( Host_Name="srv1" AND icid="va1_icid1" OR mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" OR mid="val_mid2" ))	(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" )) and (( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

That you need such a replacement means that the subsearch is incorrect for your purpose.  Usually revising the subsearch is a better option.

[yuanliu]

In addition to semantic equivalence, there is often efficiency to be gained by converting an OR group to consecutive ANDs because true parallel processing is still a pipe dream for most compilers.  I suspect that's why the SPL compiler tries to optimize.

Why do you want to change format output, anyway?  If you want your search to be more semantic, you can write in any way you want.

[richgalloway]

It is not possible.  The format command (either implicit or explicit) is not that flexible.