Search Operators and Values

Search operators refine the results that are returned to you when you perform a search. Operators determine which results to display based on the value you select or enter for an artifact type. You can have up to 10,000 values in a single search with multiple search conditions. Refer to the following table when you Work with the Search Editor to set up a search.
Operator
When to Use It
Possible Values
is
Find samples or sessions that contain the exact value you enter.
  • Number
  • Option—Select a value from the drop-down.
  • String—Type an exact value (not case-sensitive).
is not
Find samples or sessions that do not contain the exact value you enter.
  • Number
  • Option—Select a value from the drop-down.
  • String—Type an exact value (not case-sensitive).
has no value
Exclude samples or sessions with reported values for the artifact type from the search results.
No value required
has any value
Find samples or sessions that have reported values for the artifact type, including values such as
0
,
unknown
, or
Not Found
.
No value required
is in the list
Find samples or sessions with artifacts that match at least one of the values from a list.
You can have up to 1,000 values in your list.
  • Option—Select more than one value from the drop-down.
  • String—Type more than one value (not case-sensitive). Press Enter to separate one value from another. The values must be exact.
operator-is-in-the-list.png
is not in the list
Exclude samples or sessions that do not have at least one value from a list.
You can have up to 1,000 values in your list.
  • Option—Select more than one value from the drop-down.
  • String—Type more than one value (not case-sensitive). Press Enter to separate one value from another. The values must be exact.
contains
Find samples or sessions that contain the partial value you enter.
Use the
contains
operator if you don’t know the exact value of an artifact.
String—Type a partial value (not case-sensitive).
Learn more about the Guidelines for Partial Searches.
operator-contains-2.png
does not contain
Find samples or sessions that do not have the partial value you enter.
String—Type a partial value (not case-sensitive).
Learn more about the Guidelines for Partial Searches.
proximity
Perform a single search for two or more values.
Use the proximity operator with Analysis Artifacts to look for multiple artifacts that can appear in the WildFire analysis of a sample.
String—Type partial values if you don’t know the exact value (not case-sensitive). You can enter the values in any order.
Learn more about the Guidelines for Partial Searches.
operator-proximity.png
is in the range
Find values within a date or numerical range.
  • Date and Time Range—Select the earliest and latest possible date and time that a value can be, or choose from a drop-down of relative dates, such as
    Yesterday
    ,
    Last Month
    , or
    Last 90 days
    .
  • Number Range—Select a minimum and maximum number that a value can be.
operator-is-in-the-range.png
greater than
Find values that are more than the number you enter.
Number
greater than or equal
Find values that are more than or equal to the number you enter.
Number
less than
Find values that are less than the number you enter.
Number
less than or equal
Find values that are less than or equal to the number you enter.
Number
is after
Find date and time values that occur after a specific date.
Date and Time—Select a date and time, or choose from a drop-down of relative dates such as
Yesterday
,
Last Month
, or
Last 90 days
.
operator-is-after.png
is before
Find date and time values that occur before a specific date.
Date and Time—Select a date and time, or choose from a drop-down of relative dates such as
Yesterday
,
Last Month
, or
Last 90 days
.
operator-is-before.png

Related Documentation