> For the complete documentation index, see [llms.txt](https://docs.reveald.com/technical-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.reveald.com/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/search-and-query-guidelines/complex-epiphany-queries.md).

# Complex Epiphany Queries

Using the building blocks of the search query syntax, Epiphany can allow users to create complex queries to search for specific things.

Here is a list of advanced rules to follow when using the Epiphany's search functions:

### More Than One Column and Value Pairing

More than one column and value combination can be used at once, so long as both columns reside within the same underlying index. If no logical operator is used between column and value pairings, it defaults to AND.

{% hint style="success" %}
Information about the underlying indexes and keywords used by them can be found in the [*Search Keywords*](/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/search-and-query-guidelines/search-keywords.md) section.
{% endhint %}

#### Syntax

```
<column1>:<value1> <column2>:<value2>
```

In the syntax above, both of these conditions must exist: **value1** must exist in **column1** *and* **value2** must exist in **column2**. Because no logical operator is used, the syntax defaults to AND.&#x20;

```
<column1>:<value1> <value1.2> | <column2>:<value2>
```

In the syntax above, either **value1** *and* **value1.2** must exist in **column1**, *or* **value2** must exist in **column2**.

#### Examples

```
sources:windows_ad CVE:2022* 
```

In the example above, **windows\_ad** must exist in the **sources** column, and values beginning with **2022** must exist in the **CVE** column. All entries matching these conditions will list.&#x20;

```
sources:windows_ad crowdstrike | CVE:2022*
```

In the example above, either **windows\_ad** *and* **crowdstrike** must exist in the **sources** column *or* values beginning with **2022** must exist in the **CVE** column. This would create a hybrid list showing all entries containing both windows\_ad and crowdstrike as well as all CVEs beginning with 2022.&#x20;

### Searching for Strings That Include Spaces: Use Single Quotes Only

When searching for specific strings that include spaces, use single quotes around the string. Double quotes are not allowed.&#x20;

#### Example

```
<column>:'<value in single quotes>'
```

* Only single quotes are usable when looking for specific strings with spaces.
  * Double quotes are not allowed.
  * Example: (special characters)
    * \<column>:'\<value to place in quotes>'

### Space usage in overall search structure:

* Spaces are used to delimit logical operators and to determine the end of a column/value structure.
  * \<value> \<operator> \<value>
  * \<lastvalu&#x65;*>  <*&#x6E;ext\_column>

### Space usage in values:

* Spaces in strings are only allowed within single quotes and parenthesis.
  * Example:
    * \<column>:(\<value1> | \<value2> | '\<value3 is a string with spaces in quotes>')