Search string syntax

This topic contains the following information:

• • Kinds of search string syntax
  • About phrases
  • Case-sensitive search and case-insensitive search
  • Search command chaining
  • Search string syntax samples
  • Special characters and their effect on search
  • Delimiters and their effect on search
  • Syntax for searching the product metrics file

Kinds of search string syntax

The following table describes the various kinds of syntax that you can use in your search string. For a list of examples with the appropriate search results that are expected to be highlighted, see Search-string-examples-and-their-results.

Kinds of search syntax

About phrases

The term phrase refers to a combination of alphanumeric characters separated by space. When you search for a phrase, the product matches the exact sequence as it occurs in the search string excluding the delimiters (if any).

If you search for a phrase without enclosing it in double quotes ("), the product finds all data containing one or more of the words that constitute the phrase. Conversely, if you enclose the phrase in double quotes, the search mechanism looks for data containing the entire phrase as specified.

Phrases can also be referred to as string literals.

You can also search for field values containing spaces or blank field values by treating them as a phrase.

Case-sensitive search and case-insensitive search

When you search, TrueSight IT Data Analytics ignores the case for all the search terms except field and tag names. Field names (including default fields) and tag names are case-sensitive. All other kinds of search including plain text, field values, tag values, search command names, search command operators and functions are treated in a case-insensitive way.

You can apply case-sensitivity to field and tag values by using the CASE function. To make searches on field and tag values case-sensitive, you need to enclose the field value in parenthesis and place the CASE function in front of the field value (outside the parenthesis) in the format, <fieldName>=CASE(<fieldValue>). For example, OS=CASE(WINDOWS). While specifying the CASE function, case is not important. The CASE function applied on numeric field values is ignored.

You can also apply case sensitivity when you add a field or tag value from the search results area or from the Filters panel. For more information, see Filtering-your-search-results.

The following table provides examples of case-sensitive and case-insensitive search terms.

Search command chaining

You can run search commands on the output of a particular search that you have already performed. For example, the search string, key1=value1 && stringliteral | tail 5 results in the following actions:

1. Firstly, the product searches for data that contains both key1=value1 and stringliteral.
2. Secondly, the tail search command is run on the output of the search performed in step 1.

In the course of your data investigation, you can chain a set of commands so that the output of one command is consumed as the input to the subsequent command. You can chain multiple commands by using the pipe (|) operator:

Syntax: searchString | Searchcommand1 | SearchCommand2

For more information about best practices for chaining multiple search commands, see Search commands.

Search string syntax samples

The following table lists search string syntax samples and describes how they are interpreted by the product.

Search string syntax samples

Special characters and their effect on search

You cannot search for special characters literally. During search, special characters are automatically ignored and results are returned based on the remaining terms in your search string. Results are returned irrespective of where the special character occurs in the search string (in the beginning, middle, or end).

The following examples illustrate how search functions when your search string contains special characters:

Some special characters carry a special meaning in TrueSight IT Data Analytics.

The following table lists the special characters that carry a special meaning:

If your search string contains one or more special characters included in the preceding table, then to be able to find results, you need to escape them. You can escape these special characters by enclosing the search string in double quotes (in other words, treating the search string as a phrase). However, if your search string contains double quotes, then you need to escape it by placing a backward slash (\) before the double quotes, in your search string.

The following examples illustrate how search functions when your search string contains special characters that carry a special meaning:

Delimiters and their effect on search

When you perform a search, all special characters in your data act as delimiters. Delimiters are characters that separate text strings (letters and numbers) and mark the beginning or the end of a particular text string. The common delimiters are period (.), space ( ), comma (,), semicolon (;), pipe (|), underscore (_), slashes (/ \), and so on.

Delimiters affect the way your search works and which part of the data is highlighted.

The following table provides a list of search strings and their effect on the search results that are displayed, with the text highlighted in blue:

Syntax for searching the product metrics file

If you want to perform a search on the log files generated by the product (for the Collection Station and Search components), your search string must be in the following format: 

_index=metrics searchCriteria

For more information, see Monitoring-the-product-metric-files.