# Example thing queries


Specify queries in a query string using a query syntax. The queries are passed to the [https://docs.aws.amazon.com/iot/latest/apireference/API_SearchIndex.html](https://docs.aws.amazon.com/iot/latest/apireference/API_SearchIndex.html) API. The following table lists some example query strings.


| Query string | Result | 
| --- | --- | 
|  abc  |  Queries for "abc" in any registry, shadow (classic unnamed shadow and named shadow), or Device Defender violations field.  | 
|  thingName:myThingName  |  Queries for a thing with name "myThingName".  | 
|  thingName:my\$1  |  Queries for things with names that begin with "my".  | 
|  thingName:\$1my  |  Queries for things with names that end in "my". Leading wildcard use is limited to 1 query term per query. Queries that include a leading wildcard have a max query length of 100 characters.  | 
|  thingName:\$1my\$1  |  Queries for things that contain the substring "my". Leading wildcard use is limited to 1 query term per query. Queries that include a leading wildcard have a max query length of 100 characters.  | 
|  thingName:ab?  |  Queries for things with names that have "ab" plus one additional character (for example, "aba", "abb", "abc", and so on.  | 
|  thingTypeName:aa  |  Queries for things that are associated with type "aa".  | 
|  thingGroupNames:a  | Queries for things with a parent thing group or billing group name "a". | 
|  thingGroupNames:a\$1  | Queries for things with a parent thing group or billing group name matching the pattern "a\$1". | 
|  attributes.myAttribute:75  |  Queries for things with an attribute named "myAttribute" that has the value 75.  | 
|  attributes.myAttribute:[75 TO 80]  |  Queries for things with an attribute named "myAttribute" that has a value that falls within a numeric range (75–80, inclusive).  | 
|  attributes.myAttribute:\$175 TO 80]  |  Queries for things with an attribute named "myAttribute" that has a value that falls within the numeric range (>75 and <=80).  | 
|  attributes.serialNumber:["abcd" TO "abcf"]  |  Queries for things with an attribute named "serialNumber" that has a value within an alphanumeric string range. This query returns things with a "serialNumber" attribute with values "abcd", "abce", or "abcf".  | 
|  attributes.myAttribute:i\$1t |  Queries for things with an attribute named "myAttribute" where the value is 'i', followed by any number of characters, followed by 't'.  | 
|  attributes.attr1:abc AND attributes.attr2<5 NOT attributes.attr3>10  |  Queries for things that combine terms using Boolean expressions. This query returns things that have an attribute named "attr1" with a value "abc", an attribute named "attr2" that's less than 5, and an attribute named "attr3" that' not greater than 10.  | 
|  shadow.hasDelta:true  |  Queries for things with an unnamed shadow that has a delta element.  | 
|  NOT attributes.model:legacy  |  Queries for things where the attribute named "model" is not "legacy".  | 
|  shadow.reported.stats.battery:\$170 TO 100\$1 (v2 OR v3) NOT attributes.model:legacy  |  Queries for things with the following: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/iot/latest/developerguide/example-queries.html)  | 
|  shadow.reported.myvalues:2  |  Queries for things where the `myvalues` array in the shadow's reported section contains a value of 2.  | 
|  shadow.reported.location:\$1 NOT shadow.desired.stats.battery:\$1  |  Queries for things with the following: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/iot/latest/developerguide/example-queries.html)  | 
|  shadow.name.<shadowName>.hasDelta:true  |  Queries for things that have a shadow with the given name and also a delta element.   | 
|  shadow.name.<shadowName>.desired.filament:\$1  |  Queries for things that have a shadow with the given name and also a desired filament property.   | 
|  shadow.name.<shadowName>.reported.location:\$1  |  Queries for things that have a shadow with the given name and where the `location` attribute exists in the named shadow's reported section.  | 
|  connectivity.connected:true  |  Queries for all connected devices.  | 
|  connectivity.connected:false  | Queries for all disconnected devices. | 
|  connectivity.connected:true AND connectivity.timestamp : [1557651600000 TO 1557867600000]  | Queries for all connected devices with a connect timestamp >= 1557651600000 and <= 1557867600000. Timestamps are given in milliseconds since epoch. | 
|  connectivity.connected:false AND connectivity.timestamp : [1557651600000 TO 1557867600000]  | Queries for all disconnected devices with a disconnect timestamp >= 1557651600000 and <= 1557867600000. Timestamps are given in milliseconds since epoch. | 
|  connectivity.connected:true AND connectivity.timestamp > 1557651600000  | Queries for all connected devices with a connect timestamp > 1557651600000. Timestamps are given in milliseconds since epoch. | 
|  connectivity.connected:\$1  | Queries for all devices with connectivity information present. | 
|  connectivity.disconnectReason:\$1  | Queries for all devices with connectivity disconnectReason present. | 
|  connectivity.disconnectReason:CLIENT\$1INITIATED\$1DISCONNECT  | Queries for all devices disconnected due to CLIENT\$1INITIATED\$1DISCONNECT. | 
|  deviceDefender.violationCount:[0 TO 100]  | Queries for things with a Device Defender violations count value that falls within the numeric range (0-100, inclusive).  | 
|  deviceDefender.<device-SecurityProfile>.disconnectBehavior.inViolation:true  | Queries for things that are in violation for the behavior disconnectBehavior as defined in the security profile device-SecurityProfile. Note that inViolation:false is not a valid query.  | 
|  deviceDefender.<device-SecurityProfile>.disconnectBehavior.lastViolationValue.number>2  | Queries for things that are in violation for the behavior disconnectBehavior as defined in the security profile device-SecurityProfile with a last violation event value greater than 2.  | 
|  deviceDefender.<device-SecurityProfile>.disconnectBehavior.lastViolationTime>1634227200000  |  Queries for things that are in violation for the behavior `disconnectBehavior` as defined in the security profile device-SecurityProfile with a last violation event after a specified epoch time.   | 
|  shadow.name.gps-tracker.reported.coordinates:geo\$1distance,47.6204,-122.3491,15.5km | Queries for things that are within the radial distance of 15.5 km from the coordinates of 47.6204,-122.3491. This query string applies to when your location data is stored in a named shadow. | 
|  shadow.reported.coordinates:geo\$1distance,47.6204,-122.3491,15.5km | Queries for things that are within the radial distance of 15.5 km from the coordinates of 47.6204,-122.3491. This query string applies to when your location data is stored in a classic shadow. |