---
title: "How to Use Context Search Graph Results"
slug: "how-to-use-context-search-graph-results"
description: "Results from scans run using either the Command Line or Constructor appear in a collapsible Results table."
tags: ["data export", "Scan Results", "web scanner"]
updated: 2025-12-30T16:02:15Z
published: 2025-12-30T16:02:15Z
canonical: "help.silentpush.com/how-to-use-context-search-graph-results"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Use Context Search Graph Results

This guide covers how to view, customize, expand, export, and analyze results from Web Search queries, including pivoting on domains/IPs and adding results to feeds.

### Search Results

When you execute a query in Web Search (via **Constructor** or **Command Line**), results are displayed in a collapsible Results table. The default columns include:

| Column | Description |
| --- | --- |
| `Origin_URL` | The first URL that was scanned |
| `ssl.issuer.organization` | The organization that issued the SSL/TLS certificate for the website, if applicable. |
| `header.server` | The web server software or platform identified in the HTTP response headers (e.g., Apache, Nginx). |
| `favicon_icons` | The URL or details of the favicon (favorite icon) associated with the website, typically displayed in browser tabs or bookmarks. |
| `html_body_ssdeep` | A fuzzy hash of the HTML body content, used for comparing similarity between web pages. |
| `htmltitle` | The title of the web page as defined in the HTML `title` tag. |
| `response` | The HTML response code received from the web server |
| `scan_date` | Timestamp of when a scan was performed |
| `ip` | The IP address of the server hosting the scanned URL. |
| `url` | The final URL that was scanned |

## Expand and Refine Queries

You can expand individual results to view additional field names and incorporate them into your query:

1. In the **Results** table, click **Expand** on the far right of a result row.
2. A list of field names for that result will appear (e.g., `ssl.expired`, `geoip.country_name`).
3. Left-click any blue-colored field name text and select an operator (e.g., `=` or `!=`) to add it to your query.
4. The field name is appended to your current query, which can be re-run with the new parameters.

## Customize Result Displays

To modify which data types are displayed in the Results table:

1. Click the vertical line icon next to **Basic Raw Data** in the table header.

Use checkboxes to include or exclude specific field names (e.g., show only `Domain` and `IP`).
2. The table updates to reflect your selections.

## Copy, Export, and View Raw Data

Web Search provides options to utilize the result data:

### **Copy to Clipboard**

- Click **Copy** in the top left of the **Results** table to copy all visible results.
- Alternatively, use checkboxes to select specific rows and copy only the selected ones.

### **Export Data**

- Click the **Download** icon to export the results as a CSV or JSON file.
- Choose to export all visible results or only selected rows.

### **View Raw Data**

- Click **Basic Raw Data** to view the raw data behind all results. ![](https://cdn.document360.io/8e5460b3-9d96-4b01-8bb3-6591a4af3a8c/Images/Documentation/Screenshot 2024-02-02 at 13.03.57(1).png)
- Copy the raw data to the clipboard for further analysis.

## Pivot

For any indicators in your results, use Silent Push’s [Standard Pivot Control](/v1/docs/pivot-point-control).

## Add Results to Feeds

To save results for further analysis or sharing:

1. Left-click a domain or IP in the **Results** table.
2. Select **Add to Feed/Collection**.
3. Choose:
  1. **Existing**: Add to an existing feed or collection.
  2. **New**: Create a new feed or collection.
4. **Confirm** to save the selected data.