Video
Watch this TechLib Video for a short walkthrough of searching with keyword expressions:
Videolink:
https://campus.barracuda.com/Keyword expressions allow you to construct your own complex queries in Advanced Search, letting you combine multiple keyword-based search terms that follow this basic syntax: search_field:phrase . For example, to search for all messages containing "Alert" or "Notification" anywhere in the Subject field.
- Click the Basic > Search tab, and then click Advanced.
- Select Email as the item type, and then select Keyword Expression as the parameter.
- In the text field, type: subject:"Alert" OR "Notification".
- Click Search to return all matching search results.
Table 1. Commonly used search_field values.
| Term | Description | Search Type |
| to | Search is limited to the To and Cc fields of each message | Text |
| from | Search is limited to the From field of each message | Text |
| domain | Search is limited to the domain names in the From, To, and Cc fields of each message | Domain |
| subject | Search is limited to the Subject line of each message | Text |
| body | Searches are performed in the Body of each message as well as in the contents of any message attachments | Text |
| attachment | Search is limited to the contents of message attachments | Text |
| all | Searches all fields and all data contained in each message | Text |
| stored_size | The actual message size on disk | Integer number |
| size | The raw size of the message | Integer number |
| header_date | The date header from the mail | Text |
| header_barracuda_envelope_rcpt_pretty_name | The envelope recipient's pretty name | Text |
| header_barracuda_envelope_rcpt_user | The envelope recipient | Text |
| header_bcc | The Bcc: header | Text |
| header_to | The To: header | Text |
| header_in_reply_to | The In reply to: header | Text |
| header_barracuda_envelope_rcpt_domain | The domain of the envelope recipient | Text |
| header_from | The From: header | Text |
| header_barracuda_envelope_rcpt_message_mode | Inbound / Outbound / Internal | Text |
| header_barracuda_envelope_rcpt_addr | Email address of envelope recipient | Text |
| header_subject | Subject of the email | Text |
| header_message_id | The message ID header | Text |
| object_type | Type of entry (calendar, mail, etc.) | Text |
| body_excerpt | The body of the email | Text |
| attachment_name | The attachment name | Text |
| attachment_mimetype | The attachment MIME type | Text |
| attachment_extension | The attachment's extension | Text |
You may specify other search_field values as long as the correct name for the field is used. Consult Barracuda Networks Technical Support if you are unsure of the exact syntax.
The phrase can only contain a single item. However, that one item can be any one of the following:
- a single Text-based string;
- a single Integer number-based string;
- a single Wildcarded string;
- a single Domain-based string (for to and from search_field only);
a single compound search string created by combining multiple strings with the keywords AND and OR, and grouping the phrases with parentheses to control the logic.
Table 2. Sample keyword expressions.
| to:chrislee | All messages that have "chrislee" in the To or Cc fields. |
| to:patbrown@mycompany.com | All messages containing "patbrown@mycompany.com" anywhere in the To field. |
| to:chrislee AND NOT to:patbrown | All message that have "chrislee" and does not have "patbrown" in the To field. |
| to:chrislee AND !to:patbrown | All message that have "chrislee" and does not have "patbrown" in the To field. |
| subject:"Barracuda Message Archiver" | All messages that contain the exact phrase "Barracuda Message Archiver" anywhere in the Subject line. |
| domain:(barracuda.com OR barracudanetworks.com) | All messages that were sent to or from any user in either the "barracuda.com" or "barracudanetworks.com" domain. |
| header_barracuda_envelope_rcpt_domain:sub.mycompany.com | All messages sent to any user in the @sub.mycompany.com domain. |
Proximity Syntax Form
For the keyword proximity syntax form, each keyword must be in a single Text-based string. Enter the keyword proximity syntax as search_field:"keyword keyword"~NumericValue, where search_field is the part of the email to search through.
Table 3. Sample proximity syntax.
| subject:"release Barracuda"~4 | All messages containing "release" and "Barracuda" in the Subject field within four words of each other. |
| to:"Zac Britt"~4 | All messages containing "Zac" and "Britt" anywhere in the To field within four words of each other. |
Fuzzy Search Syntax Form
Fuzzy search allows you to find words that are similar to a specified search term. For the fuzzy search syntax, enter a single keyword followed by the tilde (~). For the fuzzy search syntax form, the keyword must be in a single Text-based string.
Table 4. Sample fuzzy search syntax.
| roam~ | All messages containing words similar to roam, for example, foam, roams. |