Search Operators and Values
Table of Contents
Search Operators and Values
Search operators refine the results that are returned
to you when you perform a search. Operators determine which results
to display based on the value you select or enter for an artifact
type. You can have up to 10,000 values in a single search with multiple
search conditions. Refer to the following table when you Work
with the Search Editor to set up a search.
Operator | When to Use It | Possible Values |
|---|---|---|
is | Find samples or sessions that contain the
exact value you enter. |
|
is not | Find samples or sessions that do not contain
the exact value you enter. |
|
has no value | Exclude samples or sessions with reported
values for the artifact type from the search results. | No value required |
has any value | Find samples or sessions that have reported
values for the artifact type, including values such as 0, unknown, or Not Found. | No value required |
is in the list | Find samples or sessions with artifacts
that match at least one of the values from a list. You can
have up to 1,000 values in your list. |
|
| ||
is not in the list | Exclude samples or sessions that do not
have at least one value from a list. You can have up to 1,000 values
in your list. |
|
contains | Find samples or sessions that contain the
partial value you enter. Use the contains operator
if you don’t know the exact value of an artifact. | String—Type a partial value (not case-sensitive). Learn
more about the Guidelines
for Partial Searches. |
| ||
does not contain | Find samples or sessions that do not have
the partial value you enter. | String—Type a partial value (not case-sensitive). Learn
more about the Guidelines
for Partial Searches. |
proximity | Perform a single search for two or more
values. Use the proximity operator with Analysis
Artifacts to look for multiple artifacts that can appear
in the WildFire analysis of a sample. | String—Type partial values if you don’t
know the exact value (not case-sensitive). You can enter the values
in any order. Learn more about the Guidelines
for Partial Searches. |
| ||
is in the range | Find values within a date or numerical range. |
|
| ||
greater than | Find values that are more than the number
you enter. | Number |
greater than or equal | Find values that are more than or equal
to the number you enter. | Number |
less than | Find values that are less than the number
you enter. | Number |
less than or equal | Find values that are less than or equal
to the number you enter. | Number |
is after | Find date and time values that occur after
a specific date. | Date and Time—Select a date and time, or
choose from a drop-down of relative dates such as Yesterday, Last Month,
or Last 90 days. |
| ||
is before | Find date and time values that occur before
a specific date. | Date and Time—Select a date and time, or
choose from a drop-down of relative dates such as Yesterday, Last Month,
or Last 90 days. |
| ||