Using the Query Language

This topic provides information and instructions for using the query language.

Search expressions

The query language provides a natural mechanism for searching and processing the data model. The basic format of a search expression is:
SEARCH [in partition] <kinds> [where clause] [traversals] [ordering] [show clause] [processing]

Example of a query

As a simple example, the following query retrieves all Host objects where the OS is Microsoft Windows. It displays each host's name and how much RAM it has; the results are sorted by name.

The following example finds all nodes that mention Microsoft:

In this example, both the ordering and show clauses are absent. The search service therefore uses the taxonomy definitions to choose defaults. The results are ordered by the label attributes of each node kind found and the attributes to show are set according to the corresponding summary lists. (If no definitions are given in the taxonomy for a node kind, the results are not sorted and all attributes are shown.)

The following example searches the _System partition for Users:

When writing search queries, you should be aware that an unconstrained search can have a serious performance impact on the appliance. For example, SEARCH * would return details of every node in the entire datastore!

The sets resulting from searches (and traversals) can be named and combined using set operations. This is described in Results Post Processing.

LOOKUP expressions

Instead of performing a SEARCH, a search can be performed with a LOOKUP that simply finds one or more nodes with their node id:

An example finding a single node:

An example finding multiple nodes:

A LOOKUP cannot have a WHERE clause. It is usually used in conjunction with one or more traversals.

Metadata LOOKUP expressions

LOOKUP is also used to retrieve a number of system metadata results:

Comments

Search queries can contain comments on lines starting // . Everything is ignored from // to the end of line.

Literal strings

Literal strings used in search expressions can take a number of forms.

In normal string literals, escape characters start with backslash \ characters. Usual C-style escapes are permitted.

Strings can be 'qualified' to change their interpretation, by prefixing the string literal with a word as follows:

Keywords

In this document, query language keywords appear in upper case to make them stand out. Keywords are actually case-insensitive, so they can be specified in lowercase or mixed case.

To use an identifier that clashes with a keyword, prefix it with a $ character to prevent the parser reporting a syntax error:

For backwards-compatibility, keywords can also be escaped with the ~{{/code}} character.
The keywords are as follows:

|(((
{{code language="none"}}
AND
{{/code}}
)))|(((
Logical operator when defining conditions. See [[Logical Operators>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
AS
{{/code}}
)))|(((
Modifier defining default heading shown. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.The-SHOW-Clause.WebHome]]. Use in function result naming. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Name-binding.WebHome]].
)))
|(((
{{code language="none"}}
BY
{{/code}}
)))|(((
Used in ORDER BY clause. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Ordering.WebHome]].
)))
|(((
{{code language="none"}}
DEFINED
{{/code}}
)))|(((
Used in Definition Boolean condition. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
DESC
{{/code}}
)))|(((
Changes sort order from ascending to descending. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Ordering.WebHome]].
)))
|(((
{{code language="none"}}
EXPAND
{{/code}}
)))|(((
Used for repeated traversals. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Traversals.WebHome]].
)))
|(((
{{code language="none"}}
EXPLODE
{{/code}}
)))|(((
Used to 'explode' the items in the list into multiple output rows. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Explode.WebHome]].
)))
|(((
{{code language="none"}}
FLAGS
{{/code}}
)))|(((
Used to modify behavior with destroyed nodes, result segmentation and other characteristics. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Search-Flags-and-limits.WebHome]].
)))
|(((
{{code language="none"}}
HAS
{{/code}}
)))|(((
Used in substring and subword Boolean conditions. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
IN
{{/code}}
)))|(((
Used in containment Boolean conditions. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]]. Used with STEP when performing traversals, to move from a set of nodes to a set of relationships. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Traversals.WebHome]].
)))
|(((
{{code language="none"}}
IS
{{/code}}
)))|(((
Used in definition Boolean conditions. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
LIKE
{{/code}}
)))|(((
Deprecated synonym for {{code language="none"}}MATCHES{{/code}}.
)))
|(((
{{code language="none"}}
LOCALE
{{/code}}
)))|(((
Used to show localized column headings in queries. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.The-SHOW-Clause.WebHome]].
)))
|(((
{{code language="none"}}
LOOKUP
{{/code}}
)))|(((
Finds a single node.
)))
|(((
{{code language="none"}}
MATCHES
{{/code}}
)))|(((
Used in Boolean conditions when matching regular expressions. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
NODECOUNT
{{/code}}
)))|(((
Returns number of nodes when performing traverses. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.NODECOUNT-Expressions.WebHome]].
)))
|(((
{{code language="none"}}
NODES
{{/code}}
)))|(((
Returns a list of the traversed-to nodes. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.NODECOUNT-Expressions.WebHome]].
)))
|(((
{{code language="none"}}
NOT
{{/code}}
)))|(((
Used in substring and subword Boolean conditions. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Truth"]]. Logical operator when defining conditions. See [[Logical Operators>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Precedence"]].
)))
|(((
{{code language="none"}}
OR
{{/code}}
)))|(((
Logical operator when defining conditions. See [[Logical Operators>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
ORDER
{{/code}}
)))|(((
Used in ORDER BY clause. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Ordering.WebHome]].
)))
|(((
{{code language="none"}}
OUT
{{/code}}
)))|(((
Used with STEP when performing traversals, to move from a set of relationships to a set of nodes. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Traversals.WebHome]].
)))
|(((
{{code language="none"}}
PROCESS
{{/code}}
)))|(((
Used to summarize or modify the search results. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Results-after-processing.WebHome]].
)))
|(((
{{code language="none"}}
PROCESSWITH
{{/code}}
)))|(((
Used to summarize or modify the search results. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Results-after-processing.WebHome]].
)))
|(((
{{code language="none"}}
SEARCH
{{/code}}
)))|(((
Runs a search. See .
)))
|(((
{{code language="none"}}
SHOW
{{/code}}
)))|(((
Defines the columns to return in the search results. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.The-SHOW-Clause.WebHome]].
)))
|(((
{{code language="none"}}
STEP
{{/code}}
)))|(((
Used with IN and OUT when performing traversals, to move between nodes and relationships. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Traversals.WebHome]].
)))
|(((
{{code language="none"}}
SUBSTRING
{{/code}}
)))|(((
Used in substring Boolean condition. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
SUBWORD
{{/code}}
)))|(((
Used in subword Boolean condition. See [[Conditions>>doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome||anchor="Logicalandarithmeticexpressions-Expressions"]].
)))
|(((
{{code language="none"}}
SUMMARY
{{/code}}
)))|(((
Used to show the taxonomy-defined summary list in the search results. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.The-SHOW-Clause.WebHome]].
)))
|(((
{{code language="none"}}
TAXONOMY
{{/code}}
)))|(((
Used to order by the taxonomy-defined label and to refer to named attribute lists. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Ordering.WebHome]].
)))
|(((
{{code language="none"}}
TRAVERSE
{{/code}}
)))|(((
Used to traverse from one node to another in order to access attributes and relationships from related nodes. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Traversals.WebHome]].
)))
|(((
{{code language="none"}}
WHERE
{{/code}}
)))|(((
Filters the current set of nodes according to a Boolean condition. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Logical-and-arithmetic-expressions.WebHome]].
)))
|(((
{{code language="none"}}
WITH
{{/code}}
)))|(((
Used with the PROCESS keyword to specify the post processing function to use. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Results-after-processing.WebHome]]. Used in function result naming. See [[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Name-binding.WebHome]].
)))

== {{id name="UsingtheQueryLanguage-Kindselection"/}}Kind selection ==

A search expression must specify the [[kinds of nodes>>doc:]] to search. The specification must either be a single * character, meaning to search all kinds, or a comma-separated list of node kinds. The majority of queries specify a single kind.

== {{id name="UsingtheQueryLanguage-Relatedtopics"/}}Related topics ==

[[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Key-expressions.WebHome]]

[[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Using-the-Search-and-Reporting-service.Using-the-Query-Language.Query-Language-Functions.WebHome]]

[[doc:IT-Operations-Management.Discovery.BMC-Helix-Discovery.DAAS.Using.Searching-your-data.WebHome]]

\\