Field-Based Searches

When searching emails and files, you can search for data based on any field by typing the field name followed by a colon (:) and then the value you are looking for. While the field names are case-sensitive, the values provided in the fields are case-insensitive. Search by typing field:value in the Compliance Search box or in the Query Builder in the Advanced Search dialog box.

To search for a string in a specific field, surround the string with quotation marks:

conv: Minutes of Meeting finds Minutes in the Subject field. It will find of and Meeting in the text field.
conv:"Minutes of Meeting" finds Minutes of Meeting in the Subject field.

You can use boolean operators in field-based searches. For information about boolean operators, see Boolean Operators.

Emails

Note

When searching for emails by using the from, to, cc, bcc, fmsmtp, ccsmtp, bcsmtp, or rclst fields, the search result will not contain data if the matching value is in an email that is an attachment.

You can search emails by using the following fields:

Fields	Values	Examples
from	Name or the email address of the sender	To search for emails from John, type from:John. To search for emails from John Doe, type from:"John Doe". To search for emails from John Doe or Jane Doe, type from:("John Doe" OR "Jane Doe”).
to	Name or the email address of the receiver	To search for emails to Jane, type to:Jane. To search for emails to Jane Doe, type to:"Jane Doe".
cc	Name or the email address of the receiver	To search for emails where John Doe is in the Cc field, type cc:"John Doe".
bcc	Name or the email address of the receiver	To search for emails where John Doe is in the Bcc field, type bcc:"John Doe". Note When searching journal email data, use the Email Address advanced search field instead of the bcc field.
bcc*	not applicable	To search for emails that contain values in the bcc field, type bcc:. The search results contain all emails that have values in the bcc* field.
fmsmtp	SMTP address of the sender	To search for emails from jdoe@company.com, type fmsmtp:"jdoe@company.com".
tosmtp	SMTP address of the receiver	To search for emails to jdoe@company.com, type tosmtp:"jdoe@company.com".
ccsmtp	SMTP address of the person in the cc field	To search for emails where jdoe@company.com is in the Cc field, type ccsmtp:"jdoe@company.com".
bcsmtp	SMTP address of the person in the bcc field	To search for emails where jdoe@company.com is in the Bcc field, type bcsmtp:"jdoe@company.com".
rclst	Email address of the person in the From, To, Cc, or Bcc fields	To search for emails where jdoe@mycompnay.com is in the From, To, Cc, or Bcc fields, type rclst:”jdoe@mycompany.com”.
conv	Subject of the email	To search for emails with the subject "Minutes of Meeting", type conv:"Minutes of Meeting".
folder	Location/Path of the folder	To search for emails in the folder Inbox and its sub-folders, type folder:"Inbox".
folder_sort	Exact location/Path of the folder or sub-folder.	To search for emails in a folder that contains multiple sub-folders like Inbox\Mgmt Data\ Employees, type folder_sort:"Inbox". The search includes the Inbox and excludes the sub-folders.
szkb	Size of the email (in bytes)	To search for emails of a certain size, type szkb:"size_in_bytes" where size_in_bytes is the size of the email in bytes.
hasattach	true \| false	To search for emails that have attachments, type hasattach:true. To search for emails that do not have attachments, type hasattach:false.
attname	Name of the attachment	To search for emails with an attachment called "financial data", type attname:"financial data".
datatype	2	To return only emails, type datatype:2.
cijid	Content Indexing job ID	To search for emails for a specified Content Indexing job, type cijid:content_index_jobid where content_index_jobid is the ID for the content indexing job.
jid	Backup job ID	To search for emails for a specific backup job ID, type jid:backup_jobid where backup_jobid is the ID of the backup job.
ccn	CommCell number	To search for emails from a specific CommCell, type ccn:commcell_number where commcell_number is the ID for the CommCell.

Files

You can search files by using the following fields:

Fields	Values	Examples
conv	Subject or name of the file	To search for files with the subject "Minutes of Meeting", type conv:"Minutes of Meeting". To search for files with the title "Financial Data", type conv:"Financial Data".
url	Location/Path of the file	To search for the file Financial_Data.txt located in C:\Important Files\Finance, type url:C\:\\Important Files\\Finance or url:C\:\\Important Files. When you search with url:C\:\\Important Files\\Finance, the files in the Finance folder are displayed in the search result. When you search with url:C\:\\Important Files, the files in the Important Files folder and its sub-folders are displayed in the search result.
szkb	Size of the file (in bytes)	To search for files of a certain size, type szkb:"size_in_bytes" where size_in_bytes is the size of the file in bytes.
datatype	1	To return only files, type datatype:1.
jid	Backup job ID	To search for emails for a specific backup job ID, type jid:backup_jobid where backup_jobid is the ID of the backup job.
cijid	Content Indexing job ID	To search for files for a specified content indexing job, type cijid:content_index_jobid where content_index_jobid is the ID for the Content Indexing job.
ccn	CommCell number	To search for files from a specific CommCell, type ccn:commcell_number where commcell_number is the ID for the CommCell.