Search Filter Operators
Search filters operate on attributes in order to narrow your search results. Search criteria (predicates) are specified as <attribute> <op> <comparison>, e.g. dns_activity.activity_id = ALLOWED.
| Operator | Description |
|---|---|
= | Field equals <value>. |
== | Like =, but case insensitive. |
!= | Field does not equal <value>. |
!== | Like !=, but case insensitive. |
~, contains | String field contains <value>. |
~~, icontains | Like ~ but case insensitive. |
^=, startswith | String field starts with <value>. |
^==, istartswith | Like ^= but case insensitive. |
$=, endswith | String field ends with <value>. |
$==, iendswith | Like $= but case insensitive. |
in | Enum field is one of <values>, where values is a comma-separated list. The list may optionally be surrounded with parentheses (()). |
iin | Case insensitive in. |
<, >, <=, >= | Numeric field is less than, greater than, less than or equal to, or greater than or equal to <value> |
empty | Field is empty (ex: null or None) |
matches | String field matches a regular expression. |
imatches | Like matches but case insensitive. |
cidr | IP address field is within a CIDR range. |
not | Negates the following filter (field not contains 'value' or not field contains 'value'). |
Search Filter Operators by Attribute Data Type
| Operator | number | timestamp | string | boolean | enum | hash | IP | JSON | arrays |
|---|---|---|---|---|---|---|---|---|---|
| Equality | |||||||||
=, == | x | x | x | x | x | x | x | ||
!=, !== | x | x | x | x | x | x | x | ||
in, iin | x | x | x | x | x | x | x | ||
| Sorting | |||||||||
< | x | x | x | ||||||
<= | x | x | x | ||||||
>= | x | x | x | ||||||
> | x | x | x | ||||||
| Emptiness | |||||||||
empty | x | x | x | x | x | x | x | x | x |
| Strings | |||||||||
^=, ^== | x | ||||||||
$=,$== | x | ||||||||
~, ~~ | x | ||||||||
| Regex | |||||||||
matches | x | ||||||||
imatches | x | ||||||||
| Network | |||||||||
cidr | x | ||||||||
| Quantifiers | |||||||||
ANY | x | ||||||||
ALL | x |
String Literals
String values may be written with either single quotes ('...') or double quotes ("..."). The two delimiters are equivalent, so name = 'Okta' and name = "Okta" mean the same thing. Use whichever delimiter keeps the value readable.
-
The other quote is a literal. A single-quoted string may contain double quotes, and a double-quoted string may contain single quotes, with no escaping:
WITH file.message = "it's fine" -- value: it's fine WITH file.message = 'say "hello" now' -- value: say "hello" now -
Backslash (
\) escapes the delimiter inside its own string, so a delimiter can still be included in a string bounded by that same quote:WITH file.message = "a\"b" -- value: a"b WITH file.message = 'a\'b' -- value: a'b
The same rules apply anywhere FSQL accepts a quoted string, including FROM display names, quoted attribute captions, and LIKE patterns.
Values that are not strings — enum tokens (FAILURE), numbers, connector aliases, UUIDs, and #tags — remain unquoted.
RenderingFSQL is always echoed back using single quotes. A value you type with double quotes is re-rendered with single quotes wherever the query is displayed again (for example in an expanded-query view); the query itself is unchanged.
Updated 21 days ago