Search string syntax

A search string can contain words, phrases, name=value pairs, and search commands. Each search string expression can be enclosed in parentheses. In the absence of parentheses, the parentheses are assumed from right to left.

The search string syntax comprises two portions, initial keywords followed by search commands, as in the following example:

Search string = Keywords | Search command1 | Search command2

In this example, the following values apply:

• The first portion (keywords) refers to particular words, phrases, and name=value pairs with which you start your search.
• The second portion (search commands) can be run only on the output of the first portion. You can chain multiple search commands so that the output of one command is consumed as the input of the subsequent command.

This topic contains the following information:

Kinds of search string syntax

The following table describes the various kinds of syntax that you can use in your search string. For a list of examples with the appropriate search results that are expected to be highlighted, see Examples of search string results.

Kinds of search syntax

*

word && 
fieldName=fieldValue

fieldName=fieldValue 
&& 
fieldName=fieldValue

About phrases

The term phrase refers to a combination of alphanumeric characters separated by space. When you search for a phrase, the product matches the exact sequence as it occurs in the search string excluding the delimiters (if any).

If you search for a phrase without enclosing it in double quotes ("), the product finds all data containing one or more of the words that constitute the phrase. Conversely, if you enclose the phrase in double quotes, the search mechanism looks for data containing the entire phrase as specified.

Phrases can also be referred to as string literals.

You can also search for field values containing spaces or blank field values by treating them as a phrase.

Search command chaining

You can run search commands on the output of a particular search that you have already performed. For example, the search string, key1=value1 && stringliteral | tail 5 results in the following actions:

1. Firstly, the product searches for data that contains both key1=value1 and stringliteral.
2. Secondly, the tail search command is run on the output of the search performed in step 1.

In the course of your data investigation, you can chain a set of commands so that the output of one command is consumed as the input to the subsequent command. You can chain multiple commands by using the pipe (|) operator:

Syntax: searchString | Searchcommand1 | SearchCommand2

For detailed information about the syntax for each of the commands, see the individual search command command pages at  Search commands.

For a summary of the search syntax for each of the commands, see Search string syntax.

Search string syntax samples

The following table lists search string syntax samples and describes how they are interpreted by the product.

Search string syntax samples

Special characters and their effect on search

You cannot search for special characters literally. During search, special characters are automatically ignored and results are returned based on the remaining terms in your search string. Results are returned irrespective of where the special character occurs in the search string (in the beginning, middle, or end).

The following examples illustrate how search functions when your search string contains special characters:

Some special characters carry a special meaning in IT Data Analytics.

The following table lists the special characters that carry a special meaning:

The following examples illustrate how search functions when your search string contains special characters that carry a special meaning:

Delimiters and their effect on search

When you perform a search, all special characters in your data act as delimiters. Delimiters are characters that separate text strings (letters and numbers) and mark the beginning or the end of a particular text string. The common delimiters are period (.), space ( ), comma (,), semicolon (;), pipe (|), underscore (_), slashes (/ \), and so on.

Delimiters affect the way your search works and which part of the data is highlighted.

The following table provides a list of search strings and their effect on the search results that are displayed, with the text highlighted in blue:

Syntax for searching the product metrics file

If you want to perform a search on the log files generated by the product (for the Collection Station and Search components), your search string must be in the following format: 

_index=metrics searchCriteria

For more information, see Monitoring the product metric files.