--- title: Searching and filtering url: https://www.tines.com/stories/docs/cases/searching-filtering/ updated: 2026-08-27T23:10:55+00:00 --- *[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Cases](https://www.tines.com/llm/stories/docs/cases.md)* # Searching and filtering *[View on tines.com](https://www.tines.com/stories/docs/cases/searching-filtering/)* Case search helps you find the exact cases you need by filtering on parameters like tags, assignees, priority, SLA status, dates, as well as a free text search for case ID, name, and description. [Video](https://stream.mux.com/UwoTmXcvmEDknbqiUBdnR01JD6PbPyZvN/high.mp4) ## How case search works You can find cases two ways: a quick text search across case ID, name, and description, or structured filters that narrow by specific parameters. Most searches combine both. Each structured filter has three parts: 1. **Parameter** – what you're filtering on (for example, tag, priority, or created date). 2. **Operator** – how the parameter is matched (for example, *is*, *is not*, or *contains*). 3. **Value** – the term or selection you're matching against. The operator available to you depends on the parameter and, for many parameters, on how many values you select. When you select a single value, you'll see singular operators like *is* and *is not*. When you select two or more values, those expand to *is any of*, *is all of*, or *is not any of*. ## Quick text search The search bar at the top of the cases list is the fastest way to find a case when you already know something about it. Type any term and Tines searches across three fields at once. ![](https://www.datocms-assets.com/55802/1787870058-screenshot-2026-08-27-at-5-34-05-pm.png) - **Case ID** – the unique identifier for a case. - **Case name** – the case title. - **Description** – the content of the case's [description block](https://www.tines.com/stories/docs/case-blocks/). Comments, notes, fields, and metadata aren't included here – those have their own dedicated filters. > **TIP:** > **Jump straight to a filter** > > Start typing a filter's name in the search bar – like *tag*, *priority*, or *assignee* – and press `Tab` to convert it into a structured filter. It's a quick way to build a filter without leaving the keyboard or opening the filter menu. ### How free text search matching works Quick search uses whole-word, prefix-based matching. In practice, that means: - **It's case-insensitive.** *Phishing* and *phishing* return the same results. - **It matches word prefixes.** *phish* matches "phishing," and *invest* matches "investigation." Matching starts from the beginning of a word, so *vestigation* will *not* match "investigation." - **It splits text into words.** A title like "login-failure" is indexed as *login* and *failure*, so searching either word finds it. - **Multiple words are all required, in any order.** Searching *failed login* matches a case titled "Login attempt failed," because both terms are present. If either term is missing, the case is excluded. - **Case IDs are searchable.** Typing *1567* finds case 1567. Because matching is prefix-based, a shorter term like *15* also matches IDs such as 1500 and 1567 – so use the full ID for an exact match. - **Pasted URLs are cleaned up.** Tines strips the scheme (for example, `https://` or `hxxp://`) before searching, so pasting a URL searches the rest of it. > **NOTE:** > **Quick text search is literal** > > It matches whole-word prefixes only, so it won't correct typos (*investgation* returns nothing), expand synonyms (*bug* won't find "defect"), stem word variations (*run* won't match "running"), match mid-word substrings, or support wildcard characters like `*` or `?`. For broader matching, combine it with the structured filters. For anything beyond these three fields – comments, notes, tags, or structured attributes – use the filters described below. ### Searching mentions in descriptions Descriptions often contain [mentions ](https://www.tines.com/stories/docs/formatting-references/)– dynamic references to fields, users, stories, records, and other resources (for example, an `@` reference to a field value). Quick search *won't* find a case by the displayed value or name of a mention. ![](https://www.datocms-assets.com/55802/1787869205-screenshot-2026-08-27-at-5-19-59-pm.png) Behind the scenes, each mention is stored as an markdown-formatted reference ID, rather than its rendered value. Thus quick search matches only the stored markdown text. Cases resolves a mention to its readable value or name when it displays the description, but that resolved text is not inherently searched. For example, if the description references a username (e.g. @nick.winninger), searching that person's name won't match through the description; if it references a field holding an IP address, searching the IP address won't match either. To find a case by an underlying value, use the corresponding structured filter. ## Operators by parameter Structured filters fall into two groups: those where you choose the operator, and those where the operator is fixed. ### Parameters with selectable operators For these parameters, the operator adapts to the number of values you select.
ParameterOne valueMultiple values
Tagis, is notis all of, is any of, is not any of
Assigneeis, is notis all of, is any of, is not any of
Authoris, is notis any of, is not any of
Priorityis, is notis any of, is not any of
SLA statusis, is notis all of, is any of, is not any of
SLA typeis, is notis all of, is any of, is not any of
Status (sub-status)is, is notis any of, is not any of
Metadataisis all of, is any of
Fieldisis all of, is any of
A few parameters intentionally omit some operators: - **Priority** and **author** never offer *is all of*, because a case has exactly one priority and one author – it can't match two at once. - **Status (sub-status)** also omits *is all of* for the same reason. - **Metadata** and **field** don't offer *is not* or exclude-style operators. ### Parameters with a fixed operator These parameters use a set operator, so there's no dropdown to choose from.
ParameterOperator
Status (open or closed, specific substatus)is
Namecontains
Commentcontains
Notecontains
Searchfree text – matches case ID, name, and description
Case IDis / is any of (by value count)
Recordis / is any of (by value count)
Teamis / is any of (by value count)
Created dateon, in the last, or between
Resolved dateon, in the last, or between
Updated dateon, in the last, or between
Assigned to meis (toggle)
Subscribedis (toggle)
My open tasksis (toggle)
For date parameters, the operator is derived from the shape of the value you enter – a single date maps to *on*, a duration maps to *in the last*, and a start-and-end pair maps to *between*. > **NOTE:** Some filters are available only through the API and don't appear in the search UI – for example, filtering by a case's opened date. See the [List cases API](Ihttps://hq.tines.io/docs/api/cases/list/) for the full set of programmatic filters. ## How structured filters match Quick search matches word prefixes, but the **Record**, **Field**, and **Metadata** filters behave differently: they search the structured data attached to your cases using *exact, whole-value* matching, with wildcard support in a couple of places. ### Record filter The record filter searches across *all* field values on any record linked to a case and returns cases where a field value *exactly* equals what you typed. ![](https://www.datocms-assets.com/55802/1787869374-screenshot-2026-08-27-at-5-22-51-pm.png) - **It's a whole-value match.** The field value must equal your input in full – it isn't partial, word-based, or fuzzy. *Tines* matches a field value of "Tines," but *Tin*, *tnies*, and *login* (against "login failed") won't match. - **It searches every field at once.** You don't pick a column – the filter checks all field values across the case's linked records. - **Multiple values are OR'd.** Enter several values and a case matches if any field value equals any of them. - **Large text fields aren't searchable.** Very large text record fields are excluded, so you can't match on them. ### Field filter The field filter also uses exact, whole-value matching, but it targets *one specific field* by its key rather than searching across all of them. Use it when you know exactly which field holds the value you're looking for – for example, matching only the "Host name" field rather than any field that happens to contain the value. ![](https://www.datocms-assets.com/55802/1787869560-screenshot-2026-08-27-at-5-25-53-pm.png) - **Match a specific value.** Enter a value to find cases where that field equals it exactly. - **Match any value with **`*****`**.** Enter `*` to find every case that has the field attached, regardless of what it contains. This is a *presence* check – it matches whenever the field exists on a case, even if its value is empty. It doesn't guarantee the field has been filled in. The key difference is that the **record** parameter searches every field value at once, while **field** scopes the match to a single field. ### Metadata filter Metadata filters match against the key–value pairs stored on a case. Like the field filter, every match is exact – metadata doesn't support partial or pattern matching, so a term like `source_*` is treated as literal text, not a prefix. What metadata does allow is a standalone `*` – entered on its own in a key or value field to mean "any" and leave that side unconstrained. This makes it more flexible than the field filter. ![](https://www.datocms-assets.com/55802/1787870877-screenshot-2026-08-27-at-5-47-54-pm.png) - **Specific key and value.** Match cases where a given key equals a given value. - **Specific key, any value (**`*****`**).** Match cases that have the key set, whatever its value. - **Any key (**`*****`**), specific value.** Match cases where any key holds a given value. This is the key difference from the field filter, where only the value can be wildcarded – the field key is always a specific field. ## How operators are labeled Behind the scenes, three logical operators drive most of the labels, and the wording shifts between singular and plural based on how many values you select: - **Or** – *is* (one value) or *is any of* (two or more). - **And** – *is* (one value) or *is all of* (two or more). - **Exclude** – *is not* (one value) or *is not any of* (two or more). A separate set of operators – *contains*, *between*, *in the last*, and *on* – always uses fixed wording and doesn't change with value count. > **TIP:** Multi-value relational parameters (tags, assignees, SLA status and type, metadata, and fields) support *all of* and *none of* style matching, single-value parameters (priority, author, and status) restrict to *any of* and *is not any of*, and text, date, and toggle parameters use fixed operators. ## Best practices - **Use quick search for what you remember, filters for what you know.** Quick search spans case ID, name, and description; the *contains* filters target comments and notes specifically. - **Search word beginnings, not endings.** Because quick search matches prefixes, *phish* finds "phishing" but *ing* won't – lead with the start of the word you remember. - **Search structured data with the right filter.** To find a case by a record or field value – or by a value referenced through a mention – use the **Record** or **Field** filter, not quick search. - **Start broad, then narrow.** Begin with one high-signal filter (like status or assignee) and add filters to refine. - **Combine filters for triage views.** Pairing *assigned to me* with a priority filter is a fast way to build a personal work queue. --- ## Worked examples These examples combine multiple filters to build focused, real-world search views. ### 1. Surface SLA-breaching cases across a team **Goal:** As a team lead, find every open case owned by your team that has breached its SLA, so you can reassign or escalate.
ParameterOperatorValue
StatusisOpen
TeamisSOC – Tier 1
SLA statusis any ofBreached, At risk
Priorityis not any ofLow, Medium
**How it reads:** *open* cases belonging to `SOC – Tier 1` whose SLA status is `breached` or `at risk`, excluding `low` and `medium` priority. SLA status uses *is any of* because you're matching two values, while priority uses *is not any of* to exclude a set – and remember priority can't use *is all of*, since a case has only one priority. --- ### 2. Track a phishing campaign by tag and record **Goal:** As an analyst, pull together every case tied to a specific phishing campaign so you can see the full scope of the investigation.
ParameterOperatorValue
Tagis all ofphishing, campaign-2026-08
Recordis any ofmail.acme-vendor.example, 
https://acme-vendor.example/…t
Created datein the last14 days
How it reads: cases tagged with both `phishing` and `campaign-2026-08` (is all of), linked to a record whose field value exactly equals `mail.acme-vendor.example` or `https://acme-vendor.example/reset` (is any of), and created within the last 14 days. Because the record filter is a whole-value match, each entry must be the complete stored field value – a partial domain like `acme-vendor.example` wouldn't match `mail.acme-vendor.example`. This pairs a strict tag match with an exact record match to capture the cases tied to this campaign. Pair this search with a case group to keep the campaign organized as it evolves. --- ### 3. Build a personal end-of-week review queue **Goal:** As an analyst, review the high-signal cases you personally worked on this week – whether or not they're still assigned to you.
ParameterOperatorValue
Assigned to meisOn
SubscribedisOn
Updated datebetween2026-08-24 and 2026-08-28
Status (sub-status)is any ofIn progress, Awaiting response
**How it reads:** cases you're `assigned to` and `subscribed to`, updated *between* the two dates, whose sub-status is `in progress` or `awaiting`* response*. The two toggles use their fixed *is* operator, the date range maps to *between*, and the sub-status filter uses *is any of* – it can't use *is all of*, since a case holds one sub-status at a time. --- ## Related pages - [Overview of cases](https://hq.tines.io/docs/cases/) - [Formatting and content](https://www.tines.com/stories/docs/formatting-references/) - [List cases API](https://hq.tines.io/docs/api/cases/list/)