Search Flags and limits

Certain aspects of search behavior can be modified by setting 'flags' for the search. Flags are applied with the flags keyword, or in square brackets and affect the whole search:

SEARCH FLAGS (flag1, flag2, ...) Host WHERE ...

SEARCH [flag1, flag2, ...] Host WHERE ...

Flags can also be applied to traversals, in which case they apply to just the traversal:

SEARCH Host WHERE os_type HAS SUBWORD "linux"
TRAVERSE FLAGS (include_destroyed) :::DiscoveryAccess

SEARCH Host WHERE os_type HAS SUBWORD "linux"
TRAVERSE [include_destroyed] :::DiscoveryAccess

Flags

The following flags are available:

include_destroyed

Normally, nodes and relationships that are marked as destroyed are excluded from searches and traversals. The include_destroyed flag means that destroyed nodes and relationships are included.

exclude_current

With include_destroyed, searches involve both current and destroyed nodes; with the additional exclude_current flag, current nodes are excluded. exclude_current only makes sense when used in conjunction with include_destroyed, otherwise everything is excluded.

no_segment

Normally, a search that finds multiple target nodes segments its results so that each node kind is in a separate result set. no_segment prevents the segmentation, meaning the results are in just one set. This is generally only useful when the node kinds are similar in some way, otherwise it is impossible to define a suitable SHOW clause for the combined results.

find_relationships

Searches normally find nodes with the specified kinds. The find_relationships flag causes searches to find relationships instead.

suppress_default_links

When presented in the UI, search results are normally presented so that each row is a link to the node from which the data came. The suppress_default_links flag removes these default links.

Limits

A limit on the number of results returned can also be specified. Limits are applied using a square bracket syntax. To return five matching hosts from a search:

SEARCH [5] Host WHERE ...

Flags and limits

Limits and flags can be combined. For example, the following query returns no more than five matching hosts, and as exclude_current is used in conjunction with include_destroyed, it only returns destroyed hosts:

SEARCH [5, exclude_current, include_destroyed] Host WHERE ...