Basic criteria

The basic formats for criteria for advanced queries with the Data Discovery Suite search facility are:

property:value

[property:](int32|float|double|datetime|string|phrase|starts-with|
ends-with)(value[(,option)...])

property:(and|or|not|andnot|any|range|rank|near|onear)(value
[(,value)...][(,option)...])

You can also precede any of these formats with the not operator followed by the rest of the criterion in parentheses.

To search for object content, omit the property: entry.

One of the options you can specify is mode. For object content searches this can be any, all, or phrase, for example, mode="all".

Here are some examples of basic criteria:

  • This advanced query returns objects for which the POSIX user ID of the owner is 54:
    uid:54
  • This advanced query returns all email objects:
    contenttype:string("message/rfc822")
  • This advanced query returns all objects that are equal to or larger than 25,000 bytes:
    size:range(25000, max, from="GE")
  • This advanced query returns objects that are not email from rsilver@example.com or pcornflower@example.com:
    not(emailfrom:or(rsilver@example.com, pcornflower@example.com))
  • This advanced query returns objects with content that includes the exact phrase “account value”:
    string("account value" mode="phrase")

Most of the properties for advanced queries correspond to those for structured searches, but the property names differ, and in some cases, the values are expressed differently.