Help for Enterprise Vault Search
- Getting started with Enterprise Vault Search
- Searching for archived items
- Working with search results
- Customizing Enterprise Vault Search
- Dialog box descriptions
Query syntax to refine a simple search with Enterprise Vault Search
You can use search query syntax in a simple search to narrow your search results. The search query syntax lets you specify searches for a sender, recipient, date, attachment, and so on.
Note the following:
You can combine two search queries. For example, enter from:john contents:sales to search mails from John with the word sales in the message body or attachments.
You can use a double asterisk wildcard (**) to determine the presence or absence of a field value in items. For example, you can type cc:** to find mails that include Cc lines.
You must enclose phrases or names in quotation marks ("). For example, you must type from:"john smith" to search for john smith. If you type from:john smith, results include mails with john as the sender name and smith mentioned anywhere in the mail.
Spaces between the query syntax and the search term are ignored. For example, contents:sales and contents: sales give the same results.
Enterprise Vault dates are based on UTC (Coordinated Universal Time), an international time standard. UTC is synonymous with and a successor of GMT (Greenwich Mean Time).
You can specify a range by using a double period (..). For example, date:2013-12-01..2014-01-31 searches for items that were sent or created between December 1, 2013 and January 31, 2014. Ranges can be open-ended. For example, date:2013-12-01.. searches for items that were sent or created after December 1, 2013.
Table: Query syntax describes the available query keywords.
Table: Query syntax
Query syntax | Example | |
---|---|---|
Type this | To find | |
about: | about:sales | Items that have the word sales in either the subject or content. |
after: | after:2013-02-19 | Items that were sent or created after 2013-02-19. |
bcc: | bcc:john | Items that have john on the Bcc line. |
before: | before:2013-02-19 | Items that were sent or created before 2013-02-19. |
cc: | cc:john | Items that have john on the Cc line. |
body: or contents: | body:sales or contents:sales | Items that have the word sales in the body. |
date:today date:yesterday date:this week date:last week date:this month date:last month date:this quarter date:last quarter date:this year date:last year | Items according to when they were received, sent, or created relative to the date of the search. The simple search searches within attachments. This means that the items that were created on some other date may appear in the results if there is an attachment that corresponds to the searched date. | |
date:Monday or date:Mon, and so on. date:January or date:Jan, and so on. | Items according to the day or month they were sent or created. | |
date:2014/2/19 | Items that were created, sent, or received on 2014/2/19. You can use <,>, <=, or >=; for example date:>2014/2/19 for items that were created, sent or received after 2014/2/19. | |
date:2014/2 | Items that were created, sent, or received during February 2014. You can use <,>, <=, or >=; for example date:>2014/2 for items that were created, sent or received after February 2014. | |
filetype: | filetype:pptx | Items with the extension .pptx. |
from:john | Items with john in the sender name. | |
or hasattachment:yes | has:attachment or hasattachment:yes | Items that have at least one attachment. |
hasattachment:no | hasattachment:no | Items that do not have an attachment. |
in: | in:inbox | Items that are in the inbox folder. |
inattachments:no | inattachments:no | Exclude attachments from the search. |
size:tiny size:small size:medium size:large size:verylarge size:enormous | Items according to file size:
| |
size:<400MB | Items less than 400 MB in size. You can use <,>, <=, or >=, and MB instead of KB. | |
subject: |
subject:sales | Items with the word sales in the subject line. |
to: | to:john | Items that have been sent to john. |
You can also specify property names and values in the form property:value. The property name can be the name of an Enterprise Vault index property, or the name of a property that a third-party application has added.