spotlight

It's not much of a secret, I am a mac fan. I switched to mac
with the release of the g4, and started using OS X as soon as it was
out. Spotlight is a tool that some people still don't use to the extent
of it's powers. because of my unix background, I wanted to share how to
use the spotlight database from the command line.

using mdfind
-onlyin <directory>
special charters
many special charters are used for spotlight queries. rounded brackets are used for operations that should be done first. They are also used for the $time variables.
queries work alot like sql: kMDItemFSName = filename.jpg or kMDItemResolutionHeightDPI = 400
Remember, if you want to find <= or < to use single quotes so you don't redirect!
equals can be == or = not equal is <> or !=
working with strings
Strings can only use the = or != operators, nor do they have regular expressions. The do have a few tricks you can use. kMDItemContentTree = "audio" will return no results, because by default, strings need to be whole words. There are three flags you can throw for special cases
like this. To search for partal words, like kMDItemContentTree = "protected"cw This will search for any file type that has the word protected in it's attribute list. for example: com.apple.protected-mpeg-4-audio however, I have bought one video on iTunes and the only tags it has is public.data and public.item meaning in searchlight
to ignore case, c
to ignore case, c to ignore whitespace, w
to ignore accents (like é or ü) d
and, while you don't have full regular expressions, you do have wild cards "*protected*"
negate
When you do a search, sometimes you can use -word to search for things that don't have a word, or you can use !=

Limitations
Operator is ignored for kMDItemTextContent Example:
kMDItemTextContent = 'legacy' is the same as
kMDItemTextContent != 'legacy' is the same as
kMDItemTextContent <= 'legacy'
however documentation just says you can't use greater or less than, so it may just be a bug

if you wan to search for something that doesn't have a given word, you must also specify a word you do want to search for. If you do a negate search without a regular search, it ignores your request to negate. If you negate two words, it will return 0 results. Example:
kMDItemTextContent = '-work' is the same as
kMDItemTextContent = 'work'
kMDItemTextContent = '-work -done' returns 0 results
kMDItemTextContent = '-work done' returns documents that have the word 'done' but not 'work'

Just searching for GID or UID will not limit your results. If you search with -onlyin or with another search flag, you will get what you want.

If you search for a attribute that doesn't exists, it will be false for that item. Example: kMDItemContentTypeTree = 'public.image' && kMDItemFSCreator != '*Photoshop*' will return all the pictures that were created with something other than photoshop, unless the creating program doesn't have a value for FSCreator.

kMDItemUsedDates is a little funky. The first time the file is used, it will record full date and time, after that, all will be listed as year, month, day, and timezone. The time is always midnight GMT, if your timezone observes daylight savings, you will see the displayed time change one hour.
Also, some programs will wipeout this information when saving the file (photoshop is one.)


Important notes

kMDItemFSCreator is the wrong attribute for audio files, to read the audio files application tag use kMDItemAudioEncodingApplication
kMDItemContentType gives you file type Example: for PDF files "com.adobe.pdf"
kMDItemKind gives you who opens it: if the application for a PDF file is Preview, then it's "PDF Document", if it's set to Acrobat, then it's "Adobe PDF document"
kMDItemContentTypeTree is even more versatile, However you may need to include a few != because it may give more results than expected Example: kMDItemContentTypeTree = "public.audiovisual-content" will find all media files.


useful attributes

There are plenty of addributes I don't see any particle use for, but There are a few gems.
kMDItemDurationSeconds Length of media in seconds (movie or song... maybe more types, Don't know yet)
kMDItemFSCreator Application used to create the file. (not including the Audio encoding app)
kMDItemAudioEncodingApplication Application used to create the audio file
kMDItemFSIsExtensionHidden self explanatory
kMDItemFSLabel none = 0, gray = 1, purple = 2, etc.
kMDItemUsedDates list of timestamps the file was opened.
for a full list of attributes, apple has them here



date attributes

working with time is different than other attributes. You can't say kMDItemFSContentChangeDate = 'YYYY-MM-DD'. There is a special tool for this.
$time.now(minus x minutes)
$time.today(minus x days)
$time.yesterday(minutes x days)
$time.iso(ISO 8601 date)