TQL search and filters

Many Web UI list and table screens filter rows through the toolbar search bar. Behavior falls into three families: sidebar menu search (navigation only), plain text table search, and TQL (TobeQueryLanguage) structured filters.

See also: Top bar and search · List tables and bulk actions · Search (TQL) on the alerts dashboard

Task	Section
Tell sidebar search from table search	Two search surfaces
Use plain text on management tables	Plain text filter
Enable structured filters	TQL ON / TQL OFF
Learn filter syntax	TQL syntax
Compare numbers inside text values	Numeric comparisons on text values
Filter by age or relative dates	Relative time
Combine clauses	AND, OR, and parentheses
Use autocomplete	Autocomplete

Two search surfaces

Surface	Placeholder (examples)	Purpose
Sidebar Search	Search...	Filter menu routes; optional Alert history cards (≥2 characters)
Table toolbar	Per-screen placeholder (for example Enter the name)	Filter rows in the current table

Sidebar search is documented in Top bar and search. The rest of this page covers table search.

Plain text filter

On many Management, Access Control, and Metrics lists, the search field filters as you type when the toolbar tag shows TQL OFF.

1. Click the search field.
2. Type part of a visible column value (exact placeholder depends on the screen).
3. The table refreshes to matching rows.

Use plain text for quick name or description lookups. Switch to TQL when you need operators (contains, in lists, not equal, and so on).

TQL ON / TQL OFF

Click the toolbar tag TQL ON / TQL OFF to switch between structured column:operator:value filters and plain text. There is no sigma icon.

UI state	Behavior
TQL OFF	Plain text search (placeholder shown)
TQL ON	TQL autocomplete for column → operator → value

Examples (column names vary by table):

• name:contains:prod
• enabled:eq:true
• role:eq:Administrator

TQL-only screens

The alerts dashboard and alert history list always use TQL in the toolbar (no plain-text toggle). See Search (TQL) on the dashboard and Alert history tracking.

TQL syntax

Every filter clause follows:

column:operator:value

Part	Description
Column	Field exposed by the table (for example resource, severity, status)
Operator	Named comparison such as eq, ne, contains, in, gt, regex
Value	Literal, list, or pattern depending on the operator

Common operators

Operator	Meaning	Typical column types
eq	Equals	text, enum, number, boolean, date, duration
ne	Not equal	text, enum, number, boolean, date, duration
contains	Substring match	text, array
not_contains	Does not contain	text, array
startswith	Starts with	text
endswith	Ends with	text
in	Value in comma-separated list	text, enum, number
not_in	Value not in list	text, enum, number
gt	Greater than	number, date (fixed or now-1d), duration (openFor, silentFor), number inside text (value, attributes.<key>)
gte	Greater than or equal	number, date, duration, number inside text (value, attributes.<key>)
lt	Less than	number, date, duration, number inside text (value, attributes.<key>)
lte	Less than or equal	number, date, duration, number inside text (value, attributes.<key>)
regex	Regular expression (case-sensitive)	text
regex_i	Regular expression (case-insensitive)	text
more_severe_than	More severe than this rank (security is highest)	severity only
less_severe_than	Less severe than this rank	severity only

Not every operator applies to every column — autocomplete suggests only valid operators for the column type you chose.

Quoted values

Wrap the value in single or double quotes when it contains spaces or when you need a literal string match:

• resource:eq:"test server"
• text:contains:"disk full"

Unquoted values work for simple tokens without spaces (for example severity:eq:critical).

Attribute fields

Alert attributes use a dotted column name:

• attributes.owner:eq:team-a
• attributes.region:contains:eu

Numeric comparisons on text values

value and attributes.<key> are text columns, but they often carry a number with a unit (97%, 1.5 GB, 12ms). With gt, gte, lt, and lte on these columns the server compares the first number found in the text on both sides:

Clause	Matches
value:gt:97	98%, 120 MB, 97.5 — not 97%, not n/a
value:gte:80%	Same as value:gte:80 — the unit in the query is ignored too
attributes.usage:gte:80	attributes.usage of 80, 85%, 92.3 %
attributes.latency:lt:1.5	1,2 s (comma decimals are read as 1.2), 0.9ms

A value without any number never matches an order operator. Units are not converted (1.5 GB compares as 1.5). eq and ne stay exact text comparisons: value:eq:97 does not match 97%. Other text columns (resource, event, text, …) do not accept gt / lt.

Relative time

Two computed columns and a relative date syntax let you filter by age without typing dates. All of them are evaluated when the query runs, so a saved view or bookmark stays correct over time.

Column	Meaning	Values
openFor (Open for)	Time since the alert was created (now − createTime)	A duration: 30m, 2h, 1d, 1w (s, m, h, d, w; 1.5h allowed) or plain seconds (3600)
silentFor (Silent for)	Time since the alert was last received (now − lastReceiveTime)	Same durations

Both take eq, ne, gt, gte, lt, lte — for example openFor:gt:1d, silentFor:gte:2h. They are also sort columns: sort-by=openFor on the alerts API lists the longest-open alerts first.

Any date column (createTime, lastReceiveTime, updateTime, …) accepts now, now-<n><unit>, or now+<n><unit> in place of a fixed date: createTime:lt:now-1d, lastReceiveTime:gt:now-30m, updateTime:lt:now-1w. A fixed date (createTime:gt:2025-01-01) keeps working as before.

The visual filter builder exposes the same fields (Open for, Silent for) and a Relative switch next to each date picker — see Policies — Conditions.

Example queries

Query	Meaning
resource:eq:test AND severity:eq:critical	Resource exactly test and severity critical
resource:eq:"test"	Resource exactly the string test
resource:eq:"test" AND (severity:eq:critical OR group:contains:test)	Quoted resource plus grouped OR logic
severity:in:critical,major	Severity is critical or major
severity:more_severe_than:major	Severity rank is above major (security, critical). Lower map number = more severe
severity:less_severe_than:warning	Severity rank is below warning (minor is not included; minor is more severe than warning)
status:ne:closed	Status is not closed
resource:contains:web	Resource name contains web
resource:startswith:prod-	Resource starts with prod-
tags:in:cpu,memory	Tags include cpu or memory
createTime:gt:2025-01-01	Created after the given date
createTime:lt:now-1d	Created more than a day ago (relative date, evaluated when the query runs)
openFor:gt:1d	Open for more than one day — see Relative time
silentFor:gte:2h AND status:eq:open	Open alerts not received for two hours or more
value:gt:97	The number in value is above 97 (98%, 120 MB, …) — see Numeric comparisons on text values
attributes.usage:gte:80	The number in the usage attribute is 80 or more
isCause:eq:true	Alerts that have effects linked to them
suppressed:eq:false	Hide suppressed effects (see Cause and effect alerts)

On tables with the TQL ON / TQL OFF tag, filters typically apply as you complete each clause — follow on-screen validation. On TQL-only screens (dashboard and history), the full query syncs to the URL (q parameter) as you type valid clauses.

AND, OR, and parentheses

Combine multiple clauses in one search bar:

Token	Role
AND	Both clauses must match (default when you add another filter after a complete one)
OR	Either clause may match
( )	Group clauses — for example (severity:eq:critical OR severity:eq:major) AND environment:eq:Production

Rules of thumb:

1. Separate clauses with spaces — severity:eq:critical AND status:eq:open.
2. Use AND / OR explicitly when mixing conditions; autocomplete suggests them after a complete clause.
3. Wrap grouped logic in parentheses when OR and AND appear in the same query.

URL bookmarks

When sharing a filtered dashboard or history link, the entire TQL string is stored in the q query parameter. Use AND between clauses in the query text — do not paste raw & characters from the browser address bar, because the browser treats & as a separator between URL parameters.

Autocomplete

In TQL mode:

1. Click the search field.
2. Type a column name and : — suggestions list matching columns.
3. Choose an operator from suggestions (labeled column → op → val at the bottom of the dropdown).
4. Choose or type a value (enums may suggest known values such as severities or statuses).
5. After a complete clause, autocomplete offers AND, OR, or another column for the next filter.

The alerts dashboard documents inline validation colors (success green, error red) in Search (TQL).

Common alert columns

These columns appear on the alerts dashboard and many alert-related lists (exact availability depends on the screen and Column manager):

Column	Typical use in TQL
resource	Host, service instance, or component name
severity	Critical, Major, Minor, Warning, …
status	Open, Acknowledged, Shelved, Closed, Maintenance, …
environment	Production, Staging, Custom, …
event	Event type that triggered the alert
group	Logical alert group
origin	Source system
service	Linked service names (array)
tags	Labels on the alert (array)
text	Alert description
type	Alert classification
attributes.<key>	Custom metadata fields
value	Metric value as text; gt / lt compare the number inside it (see Numeric comparisons on text values)
openFor · silentFor	Computed durations since creation / last receive (see Relative time)
causeId · suppressed · effectCount · isEffect · isCause	Cause/effect link fields — see Cause and effect alerts

History adds columns such as changeType — see Alert history tracking.

Filters drawer vs TQL

Some screens add a Filters sidebar (time range, severity, environment). Sidebar filters combine with toolbar TQL or plain search — they are not a separate query language. Example: Alert history filters.

Best practices

1. Start plain, switch to TQL when you need operators or multiple columns.
2. Use autocomplete for column and operator names — fewer syntax errors than typing from memory.
3. Quote values that contain spaces.
4. Use dashboard TQL for alert triage — bookmark URLs with q after filtering.
5. Do not confuse sidebar Search... with table TQL — menu search never replaces alert table filters.
6. On history, prefer TQL plus Filters for time-bounded investigations.