# Complex Epiphany Queries

Using the building blocks of the search query syntax, Epiphany can allow users to create complex queries to search for specific things.

Here is a list of advanced rules to follow when using the Epiphany's search functions:

### More Than One Column and Value Pairing

More than one column and value combination can be used at once, so long as both columns reside within the same underlying index. If no logical operator is used between column and value pairings, it defaults to AND.

{% hint style="success" %}
Information about the underlying indexes and keywords used by them can be found in the [*Search Keywords*](/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/search-and-query-guidelines/search-keywords.md) section.
{% endhint %}

#### Syntax

```
<column1>:<value1> <column2>:<value2>
```

In the syntax above, both of these conditions must exist: **value1** must exist in **column1** *and* **value2** must exist in **column2**. Because no logical operator is used, the syntax defaults to AND.&#x20;

```
<column1>:<value1> <value1.2> | <column2>:<value2>
```

In the syntax above, either **value1** *and* **value1.2** must exist in **column1**, *or* **value2** must exist in **column2**.

#### Examples

```
sources:windows_ad CVE:2022* 
```

In the example above, **windows\_ad** must exist in the **sources** column, and values beginning with **2022** must exist in the **CVE** column. All entries matching these conditions will list.&#x20;

```
sources:windows_ad crowdstrike | CVE:2022*
```

In the example above, either **windows\_ad** *and* **crowdstrike** must exist in the **sources** column *or* values beginning with **2022** must exist in the **CVE** column. This would create a hybrid list showing all entries containing both windows\_ad and crowdstrike as well as all CVEs beginning with 2022.&#x20;

### Searching for Strings That Include Spaces: Use Single Quotes Only

When searching for specific strings that include spaces, use single quotes around the string. Double quotes are not allowed.&#x20;

#### Example

```
<column>:'<value in single quotes>'
```

* Only single quotes are usable when looking for specific strings with spaces.
  * Double quotes are not allowed.
  * Example: (special characters)
    * \<column>:'\<value to place in quotes>'

### Space usage in overall search structure:

* Spaces are used to delimit logical operators and to determine the end of a column/value structure.
  * \<value> \<operator> \<value>
  * \<lastvalu&#x65;*>  <*&#x6E;ext\_column>

### Space usage in values:

* Spaces in strings are only allowed within single quotes and parenthesis.
  * Example:
    * \<column>:(\<value1> | \<value2> | '\<value3 is a string with spaces in quotes>')


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.reveald.com/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/search-and-query-guidelines/complex-epiphany-queries.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.