Special Characters

This section lists some best practices for special characters.

Question Mark

Use a question mark (?) to denote that you want a property value to be the same across event types. This example returns correlated events that have the same AlertedMdrElementID value and summaries that contain 'service has started' and 'service has stopped':
```
AlertedMdrElementID=? and matches(Summary,'service has started')
AlertedMdrElementID=? and matches(Summary,'service has stopped')
```
The results are organized into groups based on their correlated value.
Only use the question mark character for correlation-based searches where each event pattern contains another condition connected with the AND operator (as in the preceding example). Using the character under any other conditions may return an error or unusual results.
You can use multiple question mark characters to create multiple correlated conditions in a single event search.

Exclamation Mark

Use an exclamation mark (!) to denote that you want a property to not match the specified value. This example returns events with all Alert Types other than Informational:
```
AlertType!='Informational'
```
Use the ! character for simple expressions and the 'not' function for more complex criteria, such as a multi-condition expression.