Basic criteria
The basic formats for criteria for advanced queries with the Data Discovery Suite search facility are:
property:value [property:](int32|float|double|datetime|string|phrase|starts-with| ends-with)(value[(,option)...]) property:(and|or|not|andnot|any|range|rank|near|onear)(value [(,value)...][(,option)...])
You can also precede any of these formats with the not
operator followed by the rest of the criterion in parentheses.
To search for object content, omit the property:
entry.
One of the options you can specify is mode
. For object content searches this can be any
, all
, or phrase
, for example, mode="all"
.
Here are some examples of basic criteria:
- This advanced query returns objects for which the POSIX user ID of the owner is 54:
uid:54
- This advanced query returns all email objects:
contenttype:string("message/rfc822")
- This advanced query returns all objects that are equal to or larger than 25,000 bytes:
size:range(25000, max, from="GE")
- This advanced query returns objects that are not email from rsilver@example.com or pcornflower@example.com:
not(emailfrom:or(rsilver@example.com, pcornflower@example.com))
- This advanced query returns objects with content that includes the exact phrase “account value”:
string("account value" mode="phrase")
Most of the properties for advanced queries correspond to those for structured searches, but the property names differ, and in some cases, the values are expressed differently.