Advanced Search

Advanced Search provides a great deal of flexibility by providing metadata and content searches in a tabbed window format. Clicking on the Advanced Search link will display the Advanced Search window. Metadata searches can be conducted for email messages, files stored on a server or workstation, and files embedded within email messages. Content searches are conducted within email messages and files using simple keyword search or complex query construction.
The query builder provides an area to craft complex queries and validate queries prior to running them. Both content and metadata search criteria can be entered in the query builder. When using the query builder tab, any search terms in the keyword tab are ignored.

Advanced Search Options and Tips

• Tabs are used to navigate and enter metadata and content search criteria.
• Search criteria for all pages are combined into a single search query.
• Content searches entered in the query builder or keyword tab are joined with an AND against all metadata search criteria.
• When using the query builder tab, criteria entered in the keyword tab is ignored.
• Use the Search Criteria page to view a summary of the entire query.
• All fields in each search page are customizable.
• When entering search criteria into a field, multiple criteria can be entered separated by a semicolon.
• Wildcards * and ? are supported when entering field criteria.

Advanced search interface overview

Field and Inter-Field Logic

Understanding how fields are populated with content, the operator to join multiple criteria within a field, and how multiple fields are joined is essential to ensure accurate results are displayed.

A field contains three components:

• Token - Allows you to select the search object for the field such as email address, subject field, domain user, or filename. Tokens can be modified by selecting the drop-down box. If a token is changed, any criteria entered in the field is discarded.
• Operand - Allows you to enter search criteria such as jdoe@company.com or file *.PDF or john smith. Multiple entries can be made within the operand component of a field with a semicolon separating each entry.
• Operator - Determine the logic AND, OR, NOT that will be used for multiple criteria within the same operand field.

Fields can be added with the + button to the right of the first field or removed with the X button to the right of the field you want to remove. To simplify the search interface, consider removing any fields that are not required.

Field logic

Field logic determines how multiple criteria is joined based on the token selected. You can use AND, OR, or NOT for most field tokens.

Example:
A search is being conducted for the email addresses JDoe* AND JSmith@abc.com. Since it is uncertain what domain JDoe belongs to, an asterisk wildcard is used. Each entry in the operand field is separated with a semicolon. The field logic is set to AND, which means only messages that contain both email addresses are displayed.
The search logic is: (JDoe* AND JSmith@abc.com)

Example of multiple search criteria within an operand field

Inter-field logic

The Inter-Field Operator determines the logic in which multiple fields will be joined. This means an individual field can have multiple search criteria joined by an AND, and multiple fields can be joined with an OR.

Example:
A search is being conducted for the email addresses JDoe* OR JSmith@abc.com. Any messages that contain the word 'gambling' must be returned. However, to limit results, any subject that includes the words 'football' or 'hockey' should not be displayed. We also want to eliminate any messages from any address from xyz.com or HJones@company.com. Each field is populated with the proper criteria and the Inter Field Operator is set to AND.

The search logic is: (JDoe* OR JSmith@abc.com) AND NOT (football OR hockey OR From:*@xyz.com OR From:HJones@company.com)

Group Logic

Multiple field groups can be added within a metadata search tab. This is most commonly used when multiple fields within a group must be joined with a different operator. This can also be used to simplify the view of complex queries.

• Groups allow for additional sets of fields to be used.
• This allows separate Inter-Field operators to be used for different groups.
• The Group Operator determines the logic in which multiple groups are joined.
• Use groups for logic such as: ((a AND b AND c) OR (d AND E)) AND ((f OR g) AND (h AND I)).

Example:
A search is being conducted for Email addresses student@company.com AND jsmith@abc.com that contains 'vacation' in the subject. In addition, any message from jdoe* AND contains the subject "trip to vegas" should be included. To accomplish this, two separate inter-field operators are required. An AND for student and jsmith that must contain "vacation" in the subject, and an OR for any message from jdoe or any message that contains "trip to vegas".
The search logic is: ((student@company.com AND jsmith@abc.com) AND ((Conv:vacation")) OR ((From:Jdoe) OR Conv:"trip to vegas"))

Group logic example

Email Search Guidelines

• Email tab is used to search Email metadata – use the keyword or query builder tab to search Email body and attachment contents.
• Use the token fields: From, To, Cc, or Bcc to search for email addresses or display names specifically in those fields.
• Use the Email address field to search for specific Email addresses regardless of what token field they appear in.
• Enter multiple search terms on the same line by using a semicolon to separate each value: jdoe; jane smith; *@cv.com
• Methods for entering Email addresses:

Full Address: jdoe@cv.com
Partial address domain not known: jdoe@*
Partial address user not known, domain known: *@cv.com (mailto:*@cv.com)

• Methods for searching display names or aliases:

Search for display name: John Doe (must be exactly as appears)
Search for display name (last, first name): "doe, john"
Search for display name partially known: john

• Use the field operator AND, OR, NOT to determine the logic for multiple search terms within the same field.

Jdoe*; jane smith with AND operator returns results that contain both terms.
Jdoe*; jane smith with OR operator returns results with either term.
Jdoe*; jane smith with NOT operator returns results that do NOT contain these terms.

• Use the inter-field operator to determine the logic for ALL fields within a field group.

TO field with jdoe*; Jane smith with the OR operator and FROM field with Hwhite* with NOT operator and the inter-field operator set to AND will return messages sent TO jdoe OR jane smith, but NOT if they came from hwhite*.

• Use multiple groups to specify different inter-field logic AND, OR, NOT for fields within each group.
• Design searches to limit search scope to relevant data. Run query, assess results and modify query to focus search results.

Subject Field

• Enter phrase or keywords contained in the subject field.
• Use double quotes "this is a phrase" to search for an exact phrase.

Attachment Name

• To search for messages with specific attachments use this field to search for document titles.
• To search for attachments with specific file types enter *.<file extension> such as *.jpg or *.doc (which will also return DOCX results).

Received Time

• Use these fields to narrow the search scope to specific date ranges.

Keyword Page

• Use the keyword search options to search for specific terms within the body or attachments of the message.

Query Builder Page

• The Query builder allows for elaborate search options for body and attachments using Boolean and proximity searches to narrow search scope.

File Search Guidelines

• File names and / or file extensions can be added to search criteria using wildcards: .pdf or *.DOC.
• Wildcards can be used to search partial filename with extension: holiday*.pdf returns all PDF files that start with holiday.
• Specify a folder to limit the file search.
• Keyword or query builder can be used to search specific files or file types containing content search criteria: *.pdf in file tab and "top secret" in keyword search returns all PDF files with "top secret" in the content.
• Use the size settings to limit results based on file size.

File Search tab search criteria

Discovery Search Guidelines

• Use the discovery tab to search based on domain users, domain groups, or files accessed by specific users or groups.
• When typing characters into a field, suggestions matching characters are displayed.
• Domain users and group searches can be refined to return files, Emails, or both.

Discovery Search tab search criteria

Client Search Guidelines

• The client search tab is used to search for files and / or Emails on a specific client or items preserved in a Case Manager case.
• Files, Emails or both can be searched.
• Use 'Filter by client name' field to locate a specific client system or Case Manager case.

Client Search tab search criteria

Query Builder

The Query Builder tab is used to craft more complex content queries. Although metadata search criteria can be entered in the query builder, it is a best practice to enter metadata search criteria in the metadata tabs such as Email and File. When using the query builder, any search criteria that was entered in the Keyword field is ignored.

Key points using the Query Builder:

• Search criteria can be entered in the basic search, keyword search, or query builder.
• Once the search criteria is entered in the query builder tab, keyword criteria is ignored.
• Enter operator logic terms AND, OR, NOT in capital letters to make queries easier to read.
• If no operator is entered between words that are not in double quotes, an AND is used to join terms.
• Searches can be conducted for content and metadata . Metadata searches are conducted using token name followed by a colon and then the search criteria (From:jdoe@abc.com).
• Always test a query by clicking the Validate Query button prior to executing the query.

Search example:
((From:jdoe@* OR From:*@abc.com) AND ("illegal" OR "football betting")) AND NOT ((To:Jsmith@xyz.com OR To:Bcarter@xyz.com) AND (conv:"hockey betting" OR hockey))

This search will return messages from jdoe@* (domain not known) or from anyone at abc.com that must contain the word "illegal" or string "football betting" but NOT to jsmith or Bcarter at xyz.com and not with the subject line "hockey betting" or "hockey".

Common search options using the query builder tab