TQL search and filters

Many Web UI list and table screens filter rows through the toolbar search bar. Behavior falls into three families: sidebar menu search (navigation only), plain text table search, and TQL (TobeQueryLanguage) structured filters.

See also: Top bar and search · List tables and bulk actions · Search (TQL) on the alerts dashboard

Task	Section
Tell sidebar search from table search	Two search surfaces
Use plain text on management tables	Plain text filter
Enable structured filters	Toggle TQL filter mode
Learn filter syntax	TQL syntax
Combine clauses	AND, OR, and parentheses
Use autocomplete	Autocomplete

Two search surfaces

Surface	Placeholder (examples)	Purpose
Sidebar Search	Search...	Filter menu routes; optional Alert history cards (≥2 characters)
Table toolbar	Per-screen placeholder (for example Enter the name)	Filter rows in the current table

Sidebar search is documented in Top bar and search. The rest of this page covers table search.

Plain text filter

On many Management, Access Control, and Metrics lists, the search field filters as you type when Toggle TQL filter mode is off (sigma icon inactive).

1. Click the search field.
2. Type part of a visible column value (exact placeholder depends on the screen).
3. The table refreshes to matching rows.

Use plain text for quick name or description lookups. Switch to TQL when you need operators (contains, in lists, not equal, and so on).

Toggle TQL filter mode

Click Toggle TQL filter mode (sigma icon) to build column:operator:value filters — the same structured pattern used across configurable tables.

UI state	Behavior
Sigma inactive	Plain text search (placeholder shown)
Sigma active	TQL autocomplete for column → operator → value

Examples (column names vary by table):

• name:contains:prod
• enabled:eq:true
• role:eq:Administrator

TQL-only screens

The alerts dashboard and alert history list always use TQL in the toolbar (no plain-text toggle). See Search (TQL) on the dashboard and Alert history tracking.

TQL syntax

Every filter clause follows:

column:operator:value

Part	Description
Column	Field exposed by the table (for example resource, severity, status)
Operator	Named comparison such as eq, ne, contains, in, gt, regex
Value	Literal, list, or pattern depending on the operator

Common operators

Operator	Meaning	Typical column types
eq	Equals	text, enum, number, boolean, date, duration
ne	Not equal	text, enum, number, boolean, date, duration
contains	Substring match	text, array
not_contains	Does not contain	text, array
startswith	Starts with	text
endswith	Ends with	text
in	Value in comma-separated list	text, enum, number
not_in	Value not in list	text, enum, number
gt	Greater than	number, date (fixed or now-1d), duration (openFor, silentFor), number inside text (value, attributes.<key>)
gte	Greater than or equal	number, date, duration, number inside text (value, attributes.<key>)
lt	Less than	number, date, duration, number inside text (value, attributes.<key>)
lte	Less than or equal	number, date, duration, number inside text (value, attributes.<key>)
regex	Regular expression (case-sensitive)	text
regex_i	Regular expression (case-insensitive)	text
more_severe_than	More severe than this rank (security is highest)	severity only
less_severe_than	Less severe than this rank	severity only

Not every operator applies to every column — autocomplete suggests only valid operators for the column type you chose.

Quoted values

Wrap the value in single or double quotes when it contains spaces or when you need a literal string match:

• resource:eq:"test server"
• text:contains:"disk full"

Unquoted values work for simple tokens without spaces (for example severity:eq:critical).

Attribute fields

Alert attributes use a dotted column name:

• attributes.owner:eq:team-a
• attributes.region:contains:eu

Example queries

Query	Meaning
resource:eq:test AND severity:eq:critical	Resource exactly test and severity critical
resource:eq:"test"	Resource exactly the string test
resource:eq:"test" AND (severity:eq:critical OR group:contains:test)	Quoted resource plus grouped OR logic
severity:in:critical,major	Severity is critical or major
status:ne:closed	Status is not closed
resource:contains:web	Resource name contains web
resource:startswith:prod-	Resource starts with prod-
tags:in:cpu,memory	Tags include cpu or memory
createTime:gt:2025-01-01	Created after the given date

On sigma-toggle tables, filters typically apply as you complete each clause — follow on-screen validation. On TQL-only screens (dashboard and history), the full query syncs to the URL (q parameter) as you type valid clauses.

AND, OR, and parentheses

Combine multiple clauses in one search bar:

Token	Role
AND	Both clauses must match (default when you add another filter after a complete one)
OR	Either clause may match
( )	Group clauses — for example (severity:eq:critical OR severity:eq:major) AND environment:eq:Production

Rules of thumb:

1. Separate clauses with spaces — severity:eq:critical AND status:eq:open.
2. Use AND / OR explicitly when mixing conditions; autocomplete suggests them after a complete clause.
3. Wrap grouped logic in parentheses when OR and AND appear in the same query.

URL bookmarks

When sharing a filtered dashboard or history link, the entire TQL string is stored in the q query parameter. Use AND between clauses in the query text — do not paste raw & characters from the browser address bar, because the browser treats & as a separator between URL parameters.

Autocomplete

In TQL mode:

1. Click the search field.
2. Type a column name and : — suggestions list matching columns.
3. Choose an operator from suggestions (labeled column → op → val at the bottom of the dropdown).
4. Choose or type a value (enums may suggest known values such as severities or statuses).
5. After a complete clause, autocomplete offers AND, OR, or another column for the next filter.

The alerts dashboard documents inline validation colors (success green, error red) in Search (TQL).

Common alert columns

These columns appear on the alerts dashboard and many alert-related lists (exact availability depends on the screen and Column manager):

Column	Typical use in TQL
resource	Host, service instance, or component name
severity	Critical, Major, Minor, Warning, …
status	Open, Acknowledged, Shelved, Closed, Maintenance, …
environment	Production, Staging, Custom, …
event	Event type that triggered the alert
group	Logical alert group
origin	Source system
service	Linked service names (array)
tags	Labels on the alert (array)
text	Alert description
type	Alert classification
attributes.<key>	Custom metadata fields

History adds columns such as changeType — see Alert history tracking.

Filters drawer vs TQL

Some screens add a Filters drawer (time range, severity, environment). Drawer filters combine with toolbar TQL or plain search — they are not a separate query language. Example: Alert history filters.

Best practices

1. Start plain, switch to TQL when you need operators or multiple columns.
2. Use autocomplete for column and operator names — fewer syntax errors than typing from memory.
3. Quote values that contain spaces.
4. Use dashboard TQL for alert triage — bookmark URLs with q after filtering.
5. Do not confuse sidebar Search... with table TQL — menu search never replaces alert table filters.
6. On history, prefer TQL plus Filters for time-bounded investigations.