Directives are modifiers that instruct the search engine how to query. Directives are separated from the rest of your query by enclosing them within curly braces ( { } ) and must come after the filter portion of the query and before the transforms. Each directive is a key/value pair specified by either the colon ( : ) or ( = ) operator, which are interchangeable. Sets are acceptable as values. You can include multiple directives by separating them by commas. The directives include:
Limit. Indicates the number of documents to search. You can use
{ limit:0 }to search all documents, but this should be used with caution as it can be hazardous when used with broad queries.Page_size. Determines the number of results to return.
Note
The page_size directive is not compatible with archive search and might produce inaccurate results if used. Trellix recommends that you do not use this directive when performing an archive search.
Offset. Indicates how far into a result set to go before returning results.
Start. Represents the earliest timestamp to return. Can be placed anywhere inside of a query.
End. Represents the latest timestamp to return. Can be placed anywhere inside of a query.