Search Syntax

RapidOSS provides a powerful search engine to query the data in the RapidOSS repository. You can use terms (single words)

RapidOSS modeled classes have multiple properties. While searching, you can use terms or phrases without specifying any property. RapidOSS will scan all properties and retrieve objects that match the term/phrase in any property. Following query string will retrieve all objects that have "Router" in any one of its properties.

Router

However, you can restrict searches to specific property by specifying the name of the property. In the following example, we are searching for any objects that have the value "Router" for the className property:

className:Router

You can also use phrases (group of words surrounded by double quotes in your searches.

"Router Down"
location:"Logan Airport"

Search is case-insensitive. The following queries would all return the same results:

Router
router
ROUTER

classname:""

Make sure that double quotes are escaped when this query is used in a script:

RsTopologyObject.search("className:\"\"")

Empty values will be indexed with value "_e". So users should avoid using "_e" reserved word as property values. prop1= "_e" - INVALID prop1="keyword _e is not allowed " - VALID

For exact match you need to surround your string with "( and )". Assume that for the name property, 2 instances are stored with values "David" and "David Smith". The following query:

name:David

will return 2 results. In order to exactly match "David", enter the query as:

name:"(David)"

which will match only one instance with name property = David

Boolean Operators

Search queries can contain multiple terms and phrases that are combined with boolean operators.
RapidOSS supports the following boolean operators:

• AND (default operator, can be omitted)
• OR
• NOT

  These operators must be uppercase in your query strings!

When multiple terms or phrases are used, the default logical operator is AND. That is, you can omit AND and a space will be interpreted as an AND between terms/phrases. The following queries would return the same results:

className:Router AND location:"New York"
className:Router location:"New York"

Wildcard Searches

Single ( ? ) and multiple ( * ) character wildcard searches are supported:

className:Ro* // multiple characters
className:R*t // multiple characters
className:Route? // single character
className:Ro?ter // single character

Wildcards can NOT be used in the beginning of the queries.

?outer // NOT valid
className:*ter // NOT valid

Grouping

Terms/phrases can be grouped:

(Router OR Switch) AND Down

The grouping can also be used with property names:

severity:(2 OR 3)  AND owner:Root

Range Searches

You can specify lower and upper bounds while entering your query. Upper and lower bounds can be inclusive (using [ ] ) or exclusive (using { } ). Here is how an inclusive range is specified:

severity:[2 TO 5]

In order to exclude the bounds, enter the query string as:

severity:{2 TO *}

Date Ranges

When the property type is date, now can be used in the query. Also, "math" like strings relating to Dates can be parsed. The following query would return all the objects that have sentAt property set to last 24 hours.

sentAt:[now-1DAY TO now]

See DateMathParser.CALENDAR_UNITS for other time units for additions/subtractions. Here is the list at the time of writing this document:

YEAR
YEARS
MONTH
MONTHS
DAY
DAYS
DATE
HOUR
HOURS
MINUTE
MINUTES
SECOND
SECONDS
MILLI
MILLIS
MILLISECOND
MILLISECONDS

Number Properties Representing Dates

Note that now applies only to properties where property type is date. In many cases, the date data is stored as a number. For these number properties that represent time in milliseconds, use currentime instead of now. The following query would return all objects that were created within the last 2 days:

createdAt:[currentTime-2days TO currentTime]

currentTime is current time in milliseconds.

Less Than, Greater Than, etc...

RapidOSS search syntax does not support less than, greater than operators, however range searches can be used for this purpose. Lets assume that we have a property called "severity" which can have values between 1 and 5 (inclusive). Here is how we can use range searches for searching fields with values less than or greater than a certain value:

Fuzzy Searches

RapidOSS supports fuzzy searches:

owneruid:Boot~

The above example will match Root for the owneruid property.

Escaping Special Characters

Some special character are used while constructing the search queries:

+ - && || ! ( ) { } [ ] ^ " ~ * ? : \

These should be escaped by putting a \ before the character. For example type:

name:device\(router\)

if you are searching for name: device(router)
Notice that ( and ) characters are escaped.

Refining Searches at the UI

Your best documentation is actually the search text field on the RapidOSS Operations Console (any one of the Event tabs or the Inventory tabs. As an example, select the Event Search tab and click on the "Critical Events" saved query under the "Default" query group. The following query string will be shown in the query text field:

severity:5

This query will retrieve all critical events with severity 5.

As you select property values in the result list, you will see that your selections will be appended to the search criteria, refining your searches. These additional terms or phrases are ANDed with the existing search criteria. Refine your searches and observe how RapidOSS constructs search strings to use them as examples for your searches.

Any field of each event in the result list can be used for refinement. For example, click on the acknowledged=Yes link and this will append this condition to the existing query string:

severity:5 acknowledged:"Yes"

It will now retrieve critical events that are acknowledged.

owneruid is another field of Event. Select the dropdown menu for the owneruid field on any one of the records, for example: owneruid:Root, and select "except" from the menu. This will modify the query as folows:

severity:5 acknowledged:"Yes" NOT owneruid: "Root"

This query will retrieve all acknowledged critical events whose owneruid is different from Root.

You can play with the RapidOSS operations console either at: "http://www.ifountain.com/rapidinsight/demo", our online demo site or with your own installation.