Working with advanced searches

With the metadata query engine, query expressions have this format:

[+|-]criterion [[+|-]criterion]...

In this expression, [+|-] is an optional Boolean operator and criterion is one of:

• A simple criterion
• One or more criteria in parentheses, in this format:

  [+|-]criterion [[+|-]criterion]...

  In this expression, criterion can be a simple criterion or one or more criteria in parentheses.

Query expressions can contain only valid UTF-8 characters.

The format for a simple advanced criterion is:

property:value

When querying for a value that’s a negative number, enclose the value in double quotation marks (").

The special criterion *:* finds all objects in all namespaces searchable by the user.

Most of the properties for advanced queries correspond to those for structured queries, but the property names differ, and in some cases, the values are expressed differently.

You can precede a criterion or an individual property value with one of these Boolean operators:

• Plus sign (+)

  Objects in the result set must contain the criterion or value following the plus sign.

• Minus sign (-)

  Objects in the result set must not contain the criterion or value following the minus sign.

The objectPath and customMetadataContent properties and tokenized content properties match text in the object path or custom metadata.

Text-based property values are text strings consisting of one or more

UTF-8 characters. The string is interpreted as one or more search terms, where each search term is a sequence of either alphabetic or numeric characters. All other characters, except wildcards, are treated as term separators.

For example, the string product123 contains two search terms — product and 123. A query based on this string finds objects for which the specified property contains at least one of product and 123.

Search terms match only complete alphabetic or numeric strings in paths or custom metadata. For example, the text strings AnnualReport, 2012, and AnnualReport_2012 match the object named AnnualReport_2012.pdf. A query expression with a text string such as Annual or 201 does not match this object.

Similarly, to query for objects with a path or custom metadata that contains the word product, you need to use the complete word product as the text string. A query expression with a text string such as prod does not match objects with a path or custom metadata containing product.

Common words such as a and is are indexed and are valid search terms. For example, a query containing the text string A3534 matches all objects with paths and custom metadata that contain the word a.

Search terms are not case sensitive. Therefore, the strings AnnualReport, Annualreport, and annualreport are equivalent.

Common words such as a and is are valid search terms. For example, a query containing the text string A3534 matches all objects with paths and custom metadata that contain the word a. To prevent such a match, use a phrase as described below.

To specify a negative number as a criterion, enclose the value in double quotation marks, for example, "-3121".

To specify a phrase as a criterion, put the text string in double quotation marks. A phrase matches paths and custom metadata that contain each of the alphabetic or numeric search terms within the quotation marks in the specified order, but any special characters or white space between the individual strings is ignored. For example, the phrase "product 123" matches custom metadata that contains any of these strings:

product 123
product123
product_123

A criterion can specify multiple values for a single property. To specify multiple values, use this format:

property:([+|-]value [[+|-]value]...)

In this format, the parentheses are required.

When you specify multiple values for a single property, you can combine values that are preceded by Boolean operators with values that do not have Boolean operators. In this case, objects that match the property values that are not preceded by Boolean operators may or may not appear in the result set, but objects that match the terms without Boolean operators are sorted higher in the query results than objects that don’t match those terms.

Objects that contain both terms are sorted higher in the query results.

You can query based on ranges of values for properties with numeric, string, or date data types. These properties are accessTime, accessTimeString, changeTimeString, dpl, hash, hashScheme, ingestTime, ingestTimeString, retention, retentionClass, retentionString, size, updateTime, updateTimeString, and utf8Name. You can also query based on ranges for content properties with numeric, string or date data types.

Criteria that query for a range of values for a single property can have either of these formats:

• For a range that includes the start and end values:

  property:[start-valueTOend-value]

  In this format, the square brackets are required.

  For example, this query expression finds objects that were ingested from 0800 through 0900 UTC on March 1, 2012, inclusive:

  ingestTimeString:[2012-03-01T08:00:00-0000 TO 2012-03-01T09:00:00-0000]

• For a range that does not include the start or end values:

  property:{start-valueTOend-value}

  In this format, the curly braces are required.

  For example, this query expression finds objects that have names that occur alphabetically between Brown_Lee.xls and Green_Chris.xls, exclusive of those values:

  utf8Name:{Brown_Lee.xls TO Green_Chris.xls}

  Noteutf8Name property values are case sensitive and are ordered according to the positions of characters in the UTF-8 character table.

You can mix square brackets and curly braces in an expression. For example, this query expression finds objects that were ingested from 0800 to 0900 UTC on March 1, 2012, including objects that were ingested at 0800 but excluding objects that were ingested at 0900:

ingestTimeString:[2012-03-01T08:00:00-0000 TO 2012-03-01T09:00:00-0000}

When querying for a range of property values, you can precede the whole criterion with a Boolean operator but you cannot precede an individual value with a Boolean operator. For example, the query expression on the first line below is valid; the criterion on the second line is not:

Valid: +retentionString:[2013-07-01T00:00:00 TO 2013-07-31T00:00:00]
Invalid: retentionString:[+2013-07-01T00:00:00 TO 2013-07-31T00:00:00]

When querying for a range of values, you can replace a value with an asterisk (*) to specify an unlimited range. For example, this query expression finds objects with a size equal to or greater than two thousand bytes:

size:[2000 TO *]

This query expression finds objects with change times before 9:00 AM, March 1, 2012 in the local time zone of the HCP system:

changeTimeString:[* TO 2012-03-01T09:00:00]

You can use the question mark (?) and asterisk (*) wildcard characters when specifying values for these object properties:

• customMetadataContent
• hash
• hashScheme
• retentionClass
• objectPath
• utf8Name
• Content properties

The metadata query engine interprets query expressions as follows:

• If the query expression consists of a single criterion without a Boolean operator, objects in the result set must meet the criterion. For example, this query expression finds objects with custom metadata that contains the string accounting:

  customMetadataContent:accounting

  The expression above is equivalent to this expression that uses the plus sign (+):

  +customMetadataContent:accounting

• If a query expression consists of multiple criteria without Boolean operators, objects in the result set must meet at least one of the criteria. For example, this query expression finds objects that have a retention setting of Deletion Allowed or are on hold or will be shredded on deletion:

  retention:0 hold:true shred:true

• The greater the number of criteria an object meets, the higher the object is in the default sort order. For example, with this query expression, objects that match all three criteria are sorted higher than those that match only two, and those that match only two are sorted higher than those that match only one:

  retention:0 hold:true shred:true

• If a plus sign precedes some search criteria but not others, the criteria that are not preceded by a plus sign have no effect on which objects are returned. For example, this query expression finds objects that have a utf8Name property with the value Q1_2012.ppt, regardless of whether they are in the finance namespace owned by the europe tenant:

  +utf8Name:"Q1_2012.ppt" namespace:"finance.europe"

  Objects that match the namespace criterion are sorted higher in the result set than those that do not match it.

• If a minus sign precedes some search criteria but not others and no criteria have plus signs, the query expression finds objects that do not match the criteria preceded by the minus signs and do match at least one of the criteria without a Boolean operator. For example, this query expression finds objects that are not in the finance namespace owned by the europe tenant and can be deleted.

  -(namespace:"finance.europe") retention:0

  This query finds objects that are not in the finance namespace owned by the tenant named europe and either can be deleted or can be indexed (or both):

  -namespace:"finance.europe" retention:0 index:1

• If a Boolean operator precedes an opening parenthesis, that operator applies to the entire set of criteria inside the parentheses, not the individual criteria. For example, this query expression finds objects that are on hold or have a retention setting of Deletion Prohibited:

  +(hold:true retention:-1)

• These characters have special meaning when specified in query expressions:

  ? * + - ( ) [ ] { } " :

  To specify one of these characters without special meaning in a query expression, precede the character with a backslash (\). To specify a backslash in a query expression, precede the backslash with another backslash.

The basic formats for criteria for advanced queries with the Data Discovery Suite search facility are:

property:value

[property:](int32|float|double|datetime|string|phrase|starts-with|
ends-with)(value[(,option)...])

property:(and|or|not|andnot|any|range|rank|near|onear)(value
[(,value)...][(,option)...])

You can also precede any of these formats with the not operator followed by the rest of the criterion in parentheses.

To search for object content, omit the property: entry.

One of the options you can specify is mode. For object content searches this can be any, all, or phrase, for example, mode="all".

Here are some examples of basic criteria:

• This advanced query returns objects for which the POSIX user ID of the owner is 54:

  uid:54

• This advanced query returns all email objects:

  contenttype:string("message/rfc822")

• This advanced query returns all objects that are equal to or larger than 25,000 bytes:

  size:range(25000, max, from="GE")

• This advanced query returns objects that are not email from rsilver@example.com or pcornflower@example.com:

  not(emailfrom:or(rsilver@example.com, pcornflower@example.com))

• This advanced query returns objects with content that includes the exact phrase “account value”:

  string("account value" mode="phrase")

Most of the properties for advanced queries correspond to those for structured searches, but the property names differ, and in some cases, the values are expressed differently.

For complex criteria, you can use these formats:

criterion [(and|or|andnot|any|rank|near|onear) criterion]...

criterion [(and|or|andnot|any|rank|near|onear)(criterion)]...

In these formats, criterion is any basic or complex criterion.

As with basic criteria, you can precede these formats with the not operator followed by the rest of the complex criterion in parentheses.

The table below presents the properties you can use in advanced queries while the Data Discovery Suite search facility is active. For each property, the table shows the case-sensitive property name, the data type, a description, an example, and the equivalent structured search property, if any. Values for properties with a data type of string follow the rules for search terms in simple searches.