Use Reserved Words in a Query
To ensure the system correctly parses your query, if your search entity name includes one of the reserved words listed before, you should surround the query name with quotes (" ") in order to avoid ambiguity in the query statement.
For example, if your query name is: "System warnings and errors" use the following notation: #"System warnings and errors."
| Reserved Words for Queries | ||
|---|---|---|
| and | as | between |
| by | category | connecting to |
| contain | contains | custom float |
| distinct | does not contain | does not end with |
| does not start and end with | domain | ends with |
| endswith | equal | equals |
| filter | for | greater |
| greater equal | greater equal than | greater than |
| gte | has | has substring |
| hostname | ibt | id |
| in between | in cidr block | in list |
| in list of | in subnet | is |
| is between | is equal | is equal to |
| is greater | is greater or equal than | is greater than |
| is greater than or equal to | is larger | is larger than |
| is less | is less equal | is less or equal than |
| is less than | is less than or equal to | is lower |
| is lower than | is not | is not between |
| is not equal | is not equal to | ip |
| ip6 | label | less |
| less equal | less equal than | less than |
| like | lte | mac |
| match | nibt | not |
| not between | not equal | not equals |
| not in between | not in cidr block | not in list |
| not in subnet | not match | not within subnet |
| or | path | pipe |
| port | span | starts and ends with |
| starts with | startswith | timestamp |
| username | uri | url |
| where | wheresql | within subnet |
| withinsubnet |