Syntax rules
    • 24 Mar 2024
    • 1 Minute to read
    • Dark

    Syntax rules

    • Dark

    Article summary

    SPQL's syntax is comprised of a combination of three elements:

    1. Field names
    2. Operators
    3. Values

    Each element is separated by a space, and linked together with an AND separator.

    Example query

    favicon_murmur3 = 309020573 AND domain =

    This query scans for the favicon murmur3 hash of "309020573" across domains containing


    Using OR is not supported, but conditions related to a field name may be given as a list surrounded by square brackets, separated by a comma.

    Each entry in such lists will be treated as an OR condition for that field.

    Field names

    Field names are input parameters from one of the supported SPQL fields.


    favicon_md5 is a field name that displays the favicon md5 hash of a website.


    =Matches a value
    !=Is not equal to
    >=Greater than or equal to
    <=Less than or equal to
    >Greater than
    <Less than
    ~=Regular expression match
    !~=Regular expression mismatch


    A value is data related to a field name.

    Example is a value of the domain field name

    Values must match the datatype of the field name (e.g. string, boolean).

    If the datatype is a string, then the condition may include one or more wildcards (*).

    Values containing a regular expression must be surrounded by forward slashes (/).


    Values containing a space must be surrounded by double quotes (“”).

    Regular expressions

    Regular expressions must match the entire field contents.

    A start anchor (^) and end anchor ($) are implied if they are not explicitly provided by the user.

    Please note that only RE2 expressions are supported.

    Was this article helpful?

    What's Next