ISC Search _exists_ keyword unexpected behavior

Hi Team,

According to documentation Building a Search Query - SailPoint Identity Services, we can use the _exists_ keyword to search for items that have any non-null value in the specified field.

Also according to the same documentation, the NOT operator, which can be symbolized with an exclamation point !, excludes search items that contain the term you enter after NOT in the fields you specify.

So if we use the query !_exists_:attributes.endDate, we would expect to see the list of all identities that have a non-null value for endDate.

See screenshot:

Note that even we do find the identities who have no end date, we can also find identities that actually have a value for end date. Note that this depends on the format. 05/24/2021 will appear while 2999-12-31T00:00:00.000Z will not appear

See screenshot below of the query _exists_:attributes.endDate

Based on the documentation (and based on the meaning of the word “exists”), we would expect that having any endDate value (like 05/24/2021) should ensure that you do not appear on the list with query !_exists_:attributes.endDate

1 Like

Hey Angelo!

Have you tried using “NOT exists:attributes.endDate” instead of “!exists:attributes.endDate”?

In the “Using the exists Keyword” section in the Building a Search Query documentation, this is the syntax it states to use (using NOT instead of !).

Hi @zachm117, thank you for your response,
I have tried that, the same results show up.

Note that the NOT and ! operator are supposed to be synonyms according to the documentation.
I happen to prefer the ! operator as it is slightly more intuitive what the order of operations is and which part gets negated due to the fact that the exclamation mark doesn’t require a space after it. For example:
NOT location:London AND jobTitle:Accountant
!location:London AND jobTitle:Accountant
With the second option it feels more intuitive to me that the sentence is “give me all Accountants that are not located in London” instead of “give me all identities except for the London based Accountants”.

I got an update from SailPoint yesterday. They say this is not a bug and working as designed.
This output we get from using this search query is exactly what they want to give as output.
Based on the SailPoint documentation I have seen, I disagree with their statement that this is working as expected. I will have to follow up on this.
(FYI: the ticket is #PLTDP-4093)

1 Like

The last reply to this topic was 12 months ago. Your reply will bump the topic to the top of its list and notify anyone previously involved in the conversation.

I am often surprised by the meaning of words.
So it seems that _exists_ is not an English word. Maybe it should be renamed to _exists_and_has_the_publicly_unspecified_format_desired_by_sp_.

Maybe they should at these “corner cases” to their documentation.

1 Like