Netskope Help

Filter Expressions

Filter expressions are an advanced way to filter reports, and this page describes how to write them. In the Explore section you can use them by adding a filter and choosing the matches (advanced) option.

String

EXAMPLE

DESCRIPTION

FOO

is equal to “FOO”, exactly

FOO,BAR

is equal to either “FOO” or “BAR”, exactly

%FOO%

contains “FOO”, matches “buffoon” and “fast food”

FOO%

starts with “FOO”, matches “foolish” and “food” but not “buffoon” or “fast food”

%FOO

ends with “FOO”, matches “buffoo” and “fast foo” but not “buffoon” or “fast food”

F%OD

starts with an “F” and ends with “OD”, matches “fast food”

EMPTY

string is empty (has zero characters) or is null (no value)

NULL

value is null (when it is used as part of a filter expression, place NULL in quotes, as shown on the filters documentation page)

-FOO

is not equal to “FOO” (is any value except “FOO”), matches “pizza”, “trash”, “fun” but not “foo”

-FOO,-BAR

is not equal to either “FOO” or “BAR”, matches any value except “FOO” and “BAR”

-%FOO%

doesn’t contain “FOO”, does not match “buffoon” or “fast food”

-FOO%

doesn’t start with “FOO”, does not match “foolish” or “food”

-%FOO

doesn’t end with “FOO”, does not match “buffoo” or “fast foo”

-EMPTY

string is not empty (has at least one character)

-NULL

value of column is not null (when it is used as part of a filter expression, place -NULL in quotes, as shown on the filters documentation page)

FOO%,BAR

starts with “FOO” or is “BAR” exactly, matches “food” and matches “bar” but not “barfood”

FOO%,-FOOD

starts with “FOO” but is not “FOOD”

_UF

has any single character followed by “UF”, matches “buffoon”

BOOLEAN

Filtering on true or false type values requires you to know what type of true or false value you’re interacting with.

Table 1. BOOLEAN

EXAMPLE

DESCRIPTION

yes or Yes

field evaluates to true

no or No

field evaluates to false



NUMBER

Filters on numbers support both natural language expressions (for example, 3 to 10) and relational operators (for example, >20). The system supports the OR operator to express multiple filter ranges (for example, 3 to 10 OR 30 to 100). The AND operator can be used to express numeric ranges with relational operators (for example, >=3 AND <=10) to specify a range. Filters on numbers can also use algebraic interval notation to filter numeric fields.

Warning

The syntax for numeric filter expressions using NOT may not be intuitive. The examples below show how to use it.

EXAMPLE

DESCRIPTION

5

is exactly 5

NOT 5

<>5

!=5

is any value but exactly 5

1, 3, 5, 7

is one of the values 1, 3, 5, or 7, exactly

NOT 66, 99, 4

is not one of the values 66, 99, or 4, exactly

1, NOT 2

is neither 1 nor 2

1, NOT 2, >100

is neither 1, nor 2, nor greater than 100

5, NOT 6, NOT 7

is 5, is not 6 or 7

5.5 to 10

>=5.5 AND <=10

is 5.5 or greater but also 10 or less

NOT 3 to 80.44

<3 OR >80.44

is less than 3 or greater than 80.44

1 TO

>=1

is 1 or greater

to 10

<=10

is 10 or less

>10 AND <=20 OR 90

is greater than 10 and less than or equal to 20, or is 90 exactly