Grammar and Special Characters

The following table defines the grammar and special characters that, when combined with the query components (stanzas, functions, operators, and arguments), create SIQL queries.

Grammar & Special Characters
Character Name Character or Syntax Example Description
String 'value' 'today' A value surrounded by single quotation marks. String arguments are case sensitive.
Number  

1

30

11.01

 A positive floating point or integer value. Numbers can match fields with any flag that represents any number, or a field that spans a given range.
Date or Date Time

Date (without time component)

yyyy-mm-dd

Date and Time

  • yyyy-mm-dd'T'HH:mm["ss][-offset]

    •  

    Date (without time component)

    2012-01-01

    Date and Time

    2012-0101T14:49:01-15

    A calendar date and, optionally, a time.
    Boolean TRUE

    device{active=true)

    rule{application.any=false}

    		 A true or false value.
    Pipe | devicegroup{id = 5} | fields(controlstat)

    You can add a pipe to the end of an filter to act as a throttle to control how much additional data is returned for a stanza.
    Curly brackets {} rule{true}

    The curly brackets enclose expressions and most functions. The first field name appears inside the curly brackets. If you are entering multiple expressions for a single data source, the curly brackets close after the last argument of the last expression.

    If you are using a function inside of a curly brace but not using an expression, the function is entered inside the left (opening) curly bracket. See Advanced Query Examples for more information.
    Single quote " rule{source IS SUBSET OF '192.168.20.0/24'} Single quotes are used to enclose most arguments except true or false (Boolean), and numbers.
    Asterisk * rule{source is subset of '192.168.*.*'} The asterisk can appear 0 or more times in a string and acts as the wild card character in a string.
    Space    
    • Spaces are not required between the field name, operator, and argument in expressions. When spaces are shown in this document, it is meant to make examples easier to read. Both name='Access to Accounting' and name = 'Access to Accounting' are valid expressions.
    • Spaces are required in string arguments when spaces are part of the actual values in the database. For example, if the name of a rule is Access to Accounting, then our argument for the name of a rule should be 'Access to Accounting', not 'AccesstoAccounting'.
    • Spaces are not required before or after curly braces.
    • Spaces should not be used between string argument and the single quotes that enclosed them unless you need to indicate that the argument begins with a space.
    • Spaces are required after the and and or operators that separate filters in a query, and between the and and or operators that separate expressions in a filter.
    • Spaces are required between
    Backslash \ rule{name='Accounting\'s Rule'} The backslash allows you to escape other special characters and allows the system to interpret it as part of a string.
    Type . usage(date('last 30 days')).count

    The type operator, a period, allows you to select a numerical value type, such as count or percentage, when querying usage metrics by date or date range.