SPQL's syntax is comprised of a combination of three elements:
Field names
Operators
Values
Each element is separated by a space, and linked together with an AND separator.
Example query
favicon_murmur3 = 309020573 AND domain = paypal.com
This query scans for the favicon murmur3 hash of "309020573" across domains containing paypal.com
Important!
Using OR is not supported, but conditions related to a field name may be given as a list surrounded by square brackets, separated by a comma.
Each entry in such lists will be treated as an OR condition for that field.
Field names
Field names are input parameters from one of the supported SPQL fields.
Example
favicon_md5 is a field name that displays the favicon md5 hash of a website.
Operators
Operator | Function |
|---|---|
| Matches a value |
| Is not equal to |
| Greater than or equal to |
| Less than or equal to |
| Greater than |
| Less than |
| Regular expression match |
| Regular expression mismatch |
Values
A value is data related to a field name.
Example
silentpush.com is a value of the domain field name
Values must match the datatype of the field name (e.g., string, boolean).
If the datatype is a string, then the condition may include one or more wildcards (*).
Values containing a regular expression must be surrounded by forward slashes (/).
Important!
Values containing a space must be surrounded by double quotes (“”).
Regular expressions
Regular expressions must match the entire field contents.
A start anchor (^) and end anchor ($) are implied if they are not explicitly provided by the user.
Please note that only RE2 expressions are supported.