Boolean operators combine terms through logic operators. NDR supports OR, AND, “+”, NOT and “-” as Boolean operators. Use the same steps defined in the Entering Queries section to create and run queries using Boolean Operators.
Note
Boolean operators must be ALL CAPS.
OR Operator
The OR operator links two terms and finds matching documents that contain either term. This is equivalent to a union using sets. You can also use the || symbol in place of the word OR.
Note
If there is no Boolean operator between two field filters, terms, or values, NDR search uses the OR operator as the default conjunction operator.
To search for documents that contain either a destinationTransportPort of 80 or a doc_values_type of pxflow, enter one of the following queries:
or
To construct a query for an advanced search using the OR operator, apply the following search syntax rules:
Use the querystring search syntax to construct the query.
Use double quotes around your term or value.
Separate your field filters or terms with the OR operator.
For example, if you want to retrieve sessions with either a destinationTransportPort of 443 OR 25 AND a doc_values_type of fileinfo, enter the following query:
AND Operator
The AND operator matches documents where both terms exist anywhere in the document text. This is equivalent to an intersection using sets. The symbol && can be used in place of the word AND. For example, to search for documents that contain “ASCII” and “CLOSED”, enter the text query followed by the Esc key and Enter:
Note
The TEXT: filter acts as a catchall filter for unstructured text.
Pressing the Esc key after entering a text query prevents the NDR search from automatically generating a Structured-Pill that overwrites your TEXT: filter.
You can also use the querystring syntax and double quotes around the terms to search documents that contain "ASCII" and "CLOSED".
+ Operator
The “+”, or MUST operator, requires that the term after the “+” symbol must exist somewhere in the document default field. For example, to search for documents that must contain “ASCII” and may contain “CLOSED”, enter the following query:
Note
Always append the "+" and "-" operators to the fieldname or term when used in a query string.
To search for documents that must contain “ASCII” and must contain “CLOSED”, enter the following query:
NOT Operator
The NOT operator excludes sessions that contain the term after NOT. This is equivalent to a difference using sets. The symbol ! can be used in place of the word NOT. To search for documents that contain “ASCII” but not “CLOSED”, enter the following query:
Note
The NOT operator cannot be used with just one term. For example, the following search will return no results: NOT “access granted”.
- Operator
The “-”, or prohibit operator, excludes documents that contain the term after the “-” symbol. To search for documents that must contain "ASCII" AND "TRUNCATED" but must exclude "CLOSED", enter the following query:
