Newbie in coming back around to see if there were questions on my answer I do not see my post in the thread. Either I improperly saved it but do not have a draft, it was flagged for removal or I failed to save it altogether. Unfortunate let me try to recreate it for you.
You are currently pulling all data from your DI environment across all indexes where an object is marked as sensitive. I assume you us a third party app like Symantec's DLP and not a CSV file and are tryign to filer down to a more granular dataset in your output?
We have a SDK (programmer's guide) called Veritas_Data_Insight_SDK_Guide.pdf which is located in the root of where ever you extracted the full media kit for your version of DI. This guide is the list of column values you can use in your filtering.
To filter you would add values to your get statement and then utilize them in the IF to further filer your results.
As example the parent.absname would get you the list of folders as a result where the filer\Share\foldername would be presented whereas the parent.name would result in directory or path under the share to the location of objects.
so an example of modifying your report could be:
FROM path
GET parent.name as folder, absname as filePath, size, device.name, permissions.readable_permission,
formatdate(last_accessed, "YYYY/MM/DD HH:mm") as last_accessed_time WHERE last_accessed < datetime("2017/05/01 00:00", "YYYY/MM/DD HH:mm")
AND issensitive = 1 AND type = "FILE" AND matchi(parent.name, "*finance*") = 1 AND parent.type = "DIR"
sortby parent.name asc
FORMAT permissions as CSV AND device as CSV
where finance is contained in the folder name you wish to focus on.
Note: the change to where from IF
You could filter by limiting devices to check, returning only results within a parameter like time or location, type or name, etc. The logic of refining your query to be more granular is to not eliminate every result at the same time as eliminating the undesirable ones.
Hopefully this saves properly this time and assists you with the logic required to complete your query.
Rod