Advanced Query Language
The Advanced Query Language allows users to create a single query with multiple conditions.
How to use the Advanced Query Language
To access the Advance Query Language tab, login to GFI OneConnect with a user that is member of a reviewer groupArchive users who have the ability to search and read emails that are within the scope of a group of users. and under ArchiveA feature provided by GFI OneConnect that can archive all internal and external email into the GFI OneConnect Data Center. click Search company archives. In the Search page click Advance Query Language.
To start a search:
- Type the query in the format:
field:term, wherefieldis one of the elements of an email andtermis the value you want to find. For example,mailsubject:”Quarterly Report” - Add other conditions linking them with Boolean operators. For Example,
(mailsubject:”Quarterly Report” AND mailfrom:bob@genericorp.com).
Search For Range of Dates
To search for mail using a range of dates type
a query in the format field:range(start, end)
.
| Elements | Description |
|---|---|
| Field | Field that indicates the element to be searched upon. Accepted fields are emaildate or receiveddate. |
| Range | Defines the beginning and ending points of the search. |
| Start | Indicates the beginning of the search. Date can be entered as date and time format like YYYY-MM-DDTHH:MM:SS. If time is omitted the system uses 00:00:00. Use min to indicate a search from the beginning of data stored. |
| End | Indicates the ending of the search. Date can be entered as date and time format like YYYY-MM-DDTHH:MM:SS. If time is omitted the system uses 23:59:59. Use max to indicate a search till the end of data stored. |
For example:
To find all messages sent between December 25, 2013 and August 1, 2015 (local time):
emaildate:range(2013-12-25T05:00:00, 2015-08-01T05:00:00)
To find messages sent before December 25, 2016 (local time):
emaildate:range(min, 2016-12-25T05:00:00)
To find messages received on or after August 2, 2016 (local time):
receiveddate:range(2016-08-02T05:00:00, max)
Boolean Operators
To combine search expressions using Boolean operators (AND, OR and NOT), use:
ANDbetween terms, to indicate both terms must be matched.ORbetween terms, to indicate either term may be matched, but at least one must match.NOTas a prefix to a term, to find terms that do not match the specified criteria.
Use matched parenthesis ( ) to group terms.
For example:
To find messages that include either the phrase financial report or the phrase balance sheet and were sent before December 25, 2013 or after August 1, 2015, but not between those dates.
NOT (emaildate:range (2013-12-25T05:00:00, 2015-08-01T05:00:00)) AND (“financial report” OR “balance sheet”)
Query Language Fields
The table below contains a detailed description of every field available together with some examples.
|
Field (Type) |
Description |
Example |
|
altrecipients (String)
|
Alternative recipients listed in the To field or Cc field of the envelope journal report. |
|
|
attachedfiles (String) |
|
|
|
content (String) |
The content of the message. |
|
|
dlists (String) |
Distribution lists listed in the To field or Cc field of the envelope journal report. |
|
|
emaildate
or
receiveddate (Date) |
emaildate: The date specified in the Sent Date field of the message header. receiveddate: The date the message was received by the email server. To search by date only, use the form To search by date and time, use the form
Use 24-hour clock when specifying time. Use Use < or > to specify dates before or after a certain date. Note: By default, |
|
|
envrecipients (String) |
The recipient information contained in the message envelope. For non-journaled messages: This field can be used to search for Bcc recipients. NOTE: Only email addresses found in retention policies can be found using this option. It will not find any email addresses that are external to your organization or not included in a retention policy. |
|
|
envsender (String) |
The sender information contained in the message envelope. |
|
|
filename (String) |
The file name of a document or message. |
|
|
isattachment (Integer) |
An indicator of whether the document is an email attachment or a message. To indicate that the document is an attachment, set To indicate that the document is not an attachment, set |
|
|
mailbcc (String) |
Recipients listed in the Bcc field of the envelope journal report. |
|
|
mailbccaltrecipient (String) |
Alternative recipients listed in the Bcc field of the envelope journal report. |
|
|
mailbccdlist (String) |
Distribution lists listed in the Bcc field of the envelope journal report. |
|
|
mailcc (String) |
The recipients listed in the Cc field of the message header. |
|
|
mailccaltrecipient (String) |
Alternative recipients listed in the Cc field of the envelope journal report. |
|
|
mailccdlist (String) |
Distribution lists listed in the Cc field of the envelope journal report. |
|
|
mailfrom (String) |
The sender listed in the From field of the message header. |
|
|
mailsubject (String) |
The subject of the message. If value contains spaces, enclose in double-quotes. |
|
|
mailto (String) |
The recipients listed in the To field of the message header. |
|
|
mailtoaltrecipient (String) |
Alternative recipients listed in the To field of the envelope journal report. |
|
|
mailtodlist (String) |
Distribution lists recipients listed in the To field of the envelope journal report. |
|
|
recipients (String) |
The recipients listed in one or more of the following:
|
|
|
senders (String) |
The list of senders in the message envelope or the From field of the message header. |
|
|
undisclosedrecipient (String) |
Undisclosed recipients listed in one or more of the following:
|
|