Answered my own question. This is the difference between named fields and the value itself in unmapped / un-named / different fields. This query returns the same results.
index=cfs_* [search index=cfs_* "662704824FF6C21E" | top limit=1 sessionId | fields + sessionId | rename sessionId as query]
"query" is dropped by splunk as a keyword, resulting in just the value being used for the subsequent query. Apparently you can use the "return" macro as well, but I could not get this to work.
... View more