Skope IT Query Language

This topic describes how to define and execute a search using the advanced search operations. Click the Query Mode button on any of the Skope IT pages.

Enter a query into the search field at the top of the web page. A list of values appear after entering the field and operator. For example, entering app eq micro opens a list of all apps with micro in the name. The following section provides specific usage examples for all the possible operations.

There are five types of events. They are application, page, audit, infrastructure, and alert event types.

Query language search entries consists of simple terms, groups, and Boolean operators. A simple query has the form <field><op><value>, where:

It can also be field from value1 to value2, for example, user from aaa to zzz, or timestamp from 1607990400 to 1610158997 (in Epoch Time format).

Simple terms can be combined with Boolean operators. For example: field1 eq value1 and field2 lte value2, not (field1 eq value1), field1 eq value1 or not (field2 lte value2).

Terms can be grouped by using parenthesis around them to override precedence. For example: (field1 eq value1 or field2 eq value2) and (field3 eq value3).

Refer to Skope IT Queries Library for details about specific search queries.

• Skope IT Query Language Search Examples
• Skope IT Queries Library
• Save Skope IT Searches
• Pins
• Watchlists