Search Flags and limits

Certain aspects of search behavior can be modified by setting 'flags' for the search. Flags are applied with the flags keyword, or in square brackets and affect the whole search:

SEARCH FLAGS (flag1, flag2, ...) Host WHERE ...
SEARCH [flag1, flag2, ...] Host WHERE ...

Flags can also be applied to traversals, in which case they apply to just the traversal:

SEARCH Host WHERE os_type HAS SUBWORD "linux"
TRAVERSE FLAGS (include_destroyed) :::DiscoveryAccess
SEARCH Host WHERE os_type HAS SUBWORD "linux"
TRAVERSE [include_destroyed] :::DiscoveryAccess


The following flags are available:


Normally, nodes and relationships that are marked as destroyed are excluded from searches and traversals. The include_destroyed flag means that destroyed nodes and relationships are included.


With include_destroyed, searches involve both current and destroyed nodes; with the additional exclude_current flag, current nodes are excluded. exclude_current only makes sense when used in conjunction with include_destroyed, otherwise everything is excluded.


Normally, a search that finds multiple target nodes segments its results so that each node kind is in a separate result set. no_segment prevents the segmentation, meaning the results are in just one set. This is generally only useful when the node kinds are similar in some way, otherwise it is impossible to define a suitable SHOW clause for the combined results.


Searches normally find nodes with the specified kinds. The find_relationships flag causes searches to find relationships instead.

When presented in the UI, search results are normally presented so that each row is a link to the node from which the data came. The suppress_default_links flag removes these default links.


A limit on the number of results returned can also be specified. Limits are applied using a square bracket syntax. To return five matching hosts from a search:

SEARCH [5] Host WHERE ...

Flags and limits

Limits and flags can be combined. For example, the following query returns no more than five matching hosts, and as exclude_current is used in conjunction with include_destroyed, it only returns destroyed hosts:

SEARCH [5, exclude_current, include_destroyed] Host WHERE ...
Was this page helpful? Yes No Submitting... Thank you