Skip to main content

Netskope Help

Filter Expressions

Filter expressions are an advanced way to filter reports, and this page describes how to write them. In the Explore section you can use them by adding a filter and choosing the matches (advanced) option.





is equal to “FOO”, exactly


is equal to either “FOO” or “BAR”, exactly


contains “FOO”, matches “buffoon” and “fast food”


starts with “FOO”, matches “foolish” and “food” but not “buffoon” or “fast food”


ends with “FOO”, matches “buffoo” and “fast foo” but not “buffoon” or “fast food”


starts with an “F” and ends with “OD”, matches “fast food”


string is empty (has zero characters) or is null (no value)


value is null (when it is used as part of a filter expression, place NULL in quotes, as shown on the filters documentation page)


is not equal to “FOO” (is any value except “FOO”), matches “pizza”, “trash”, “fun” but not “foo”


is not equal to either “FOO” or “BAR”, matches any value except “FOO” and “BAR”


doesn’t contain “FOO”, does not match “buffoon” or “fast food”


doesn’t start with “FOO”, does not match “foolish” or “food”


doesn’t end with “FOO”, does not match “buffoo” or “fast foo”


string is not empty (has at least one character)


value of column is not null (when it is used as part of a filter expression, place -NULL in quotes, as shown on the filters documentation page)


starts with “FOO” or is “BAR” exactly, matches “food” and matches “bar” but not “barfood”


starts with “FOO” but is not “FOOD”


has any single character followed by “UF”, matches “buffoon”


Filtering on true or false type values requires you to know what type of true or false value you’re interacting with.

Table 24. BOOLEAN



yes or Yes

field evaluates to true

no or No

field evaluates to false


Filters on numbers support both natural language expressions (for example, 3 to 10) and relational operators (for example, >20). The system supports the OR operator to express multiple filter ranges (for example, 3 to 10 OR 30 to 100). The AND operator can be used to express numeric ranges with relational operators (for example, >=3 AND <=10) to specify a range. Filters on numbers can also use algebraic interval notation to filter numeric fields.


The syntax for numeric filter expressions using NOT may not be intuitive. The examples below show how to use it.




is exactly 5




is any value but exactly 5

1, 3, 5, 7

is one of the values 1, 3, 5, or 7, exactly

NOT 66, 99, 4

is not one of the values 66, 99, or 4, exactly

1, NOT 2

is neither 1 nor 2

1, NOT 2, >100

is neither 1, nor 2, nor greater than 100

5, NOT 6, NOT 7

is 5, is not 6 or 7

5.5 to 10

>=5.5 AND <=10

is 5.5 or greater but also 10 or less

NOT 3 to 80.44

<3 OR >80.44

is less than 3 or greater than 80.44

1 TO


is 1 or greater

to 10


is 10 or less

>10 AND <=20 OR 90

is greater than 10 and less than or equal to 20, or is 90 exactly