Advanced Search Options - Auditor

Last updated on 2017-03-14 12:48:34

This article refers to the Barracuda Message Archiver firmware version 5.0 or higher.

Punctuation

Punctuation is treated as white space in search strings with the following exceptions:

Email addresses and Internet hostnames – Treated as single searchable tokens.
Example: user1@mycompany.com is treated as a single searchable token.
Period (.) – When not followed by whitespace, a period is treated as part of a word.
Example: 1.2 is treated as a single searchable token.
Hyphen (-) – When a token containing a hyphen also contains a number, the complete item is treated as a part of the number.
Examples:
MD-1800 is considered a searchable word, including the hyphen.
hyphen-madness is treated as two words ("hyphen" "madness") with the hyphen treated as whitespace.

Available Actions

Many different actions are possible from the Advanced Search interface that help you to build and save queries with multiple search parameters:

Add search parameters – Click on the plus sign (+) located to the extreme left of a search criteria line; a new search parameter line is added.
Remove a search parameter – Click on the minus sign (-) located to the left of the search parameter you wish to remove.
AND or OR search parameters – Click AND at the end of a search parameter to signifies that it is to be logically ANDed to the next specified parameter. If your next criteria is to be logically ORed, click AND to toggle it to OR.
Save a constructed query – In the SAVE AS field, enter the name under which the query is to be saved, and click SAVE AS. If you enter a name that already exists, the new search parameters overwrite the previously saved parameters under that name.
Run a previously-saved search – Select the Saved Search from the pulldown menu to load the search parameters onto the page, then click Search.

Build Search Queries

When including both AND and OR search terms in a query, the order in which these terms are placed is important. For example,

Add the first term "A", and then add term "and B"; the query searches as: (A AND B)
Add a term "or C"; the query searches as: ((A AND B) OR C)
Add a term "and D"; the query searches as: (((A AND B) OR C) AND D)

This affects preparation and ordering of Advanced Search queries as follows:

Typically, you first build a population of results by using "OR", and then subtract items from that population by using "AND". For example,

TermA OR
TermB OR
TermC AND
TermD

If you wish to force a different order of operations by placing parentheses yourself, use the Keyword Expressions search mode and construct your query according to those guidelines.

Advanced Search Parameters

Select the area of a message to which the search criteria applies.

Note that the browser time zone is used unless the time zone is specified in a search query. For example, set the search criteria to All - Date - is equal to - 2013-01-21 15:41:50 -0500 where -500 is the time zone.

From the BASIC > Search page, click on Help for additional search criteria details.

The following tables describe the available advanced search parameters.

Table 1. Search Parameter = All.

Entire Message	Look in all fields and all data contained in each item for the entered text.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
From/Owner	Look only in the From and Owner fields of each item, as applicable, for the entered text.
To/Cc	Look only in the To and Cc fields of each message for the entered text.
Subject	Look only in the Subject lines of each item for the entered text. For Distribution Lists, the name of the list is searched. For Contacts, the Full Name (both First and Last) is searched.
Date	Searches for all items with a timestamp that matches the specified date range. For Appointments, the Date is the scheduled start date and time of the Appointment, except when searching Date "is equal to". In that case, the search matches Appointments that span the provided Date. For Tasks, the Date is the date and time that the Task was created.
hh:mm:ss	Add after the date if you wish to specify a specific time on that date; the browser time zone is used unless the time zone is specified in the query, for example, 15:41:50 -0500.
Archive Time	Searches for all items added to the Barracuda Message Archiver in the specified date range.
Body	Look only in the body of each message for the entered text.
Subject/Body	Look only in the Subject line and the body of each message for the entered text.
Attachment Name	Look only in the names of message attachments for the EXACT phrase as entered
Discovery	Searches for all items that were sent or received by any email alias, address, or account that is associated with the specified email addresses, as resolved against the LDAP servers identified on the USERS > Directory Services page in the Barracuda Message Archiver web interface. Email addresses must be completely formed (username@example.com).

Table 2. Search Parameter = Email.

Entire Message	Look in all fields and all data contained in each item for the entered text.
Entire Message (Phrase)	Look in all fields and all data contained in each message for the EXACT phrase as entered.
Keyword Expressions	Searches based on a custom query using keyword expressions. Each expression must be in the form search_field:phrase
Subject/Body	Look only in the Subject line and the body of each message for the entered text.
From/To/Cc	Look only in the From, To, and Cc fields of each message for the entered text.
From	Look only in the From field of each message for the entered text.
To/Cc	Look only in the To and Cc fields of each message for the entered text.
Bcc	Look only in the Bcc field of each message for the entered text.
Domain	Look in the From, To, and Cc fields for an email address whose domain matches the entered text.
Subject	Look only in the Subject line of each message for the entered text.
Has File Attachment	Returns all messages that have at least one attachment.
Has Linked Attachment	Returns all messages that have at least one SharePoint link.
Has Attachment	Returns all messages that have at least one file attachment or linked attachment
Attachment Name	Look only in the names of message attachments for the EXACT phrase as entered.
Contains Images	Returns all messages that contain images embedded in the body.
Image Type	Look for messages with embedded images that are of the specified type. No dot (.) before the extension is needed. For example, enter gif to return all messages that contain images in the .gif format.
Inbound	Returns all messages received from an external source by any user in any domain listed in the Local Domains section of the BASIC > IP Configuration page in the web interface.
Outbound	Returns all messages sent to an external mail server by any user of any domain listed in the Local Domains section of the BASIC > IP Configuration page.
Internal	Returns all messages sent between any users of any domain listed in the Local Domains section of the BASIC > IP Configuration page.
Date	Searches for all messages with a timestamp meeting the specified date range. Dates must be entered in the YYYY-MM-DD format.
Body	Look only in the body of the message for the entered text.
Instant Message	Look only in the text of Instant Messages for the EXACT phrase as written.

Table 3. Search Parameter = Note.

Entire Message	Look in all fields and all data contained in each item for the entered text.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
Owner	Look only in the Owner field of the item for the entered text.
Subject	Look only in the Subject line of each item for the entered text.
Date	Searches for all items with a timestamp that matches the specified date range. For Appointments, the Date is the scheduled start date and time of the Appointment. For Tasks, the Date is the date and time that the Task was created.
Body	Look only in the body of each item for the entered text.
Attachment Name	Look only in the names of attachments for the EXACT phrase as entered.

Table 4. Search Parameter = Appointment.

Entire Message	Look in all fields and all data contained in each item for the entered text.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
From	Look only in the From field of each item for the entered text. For Appointments, the From field is usually equivalent to the Organizer of the Appointment, and is the sender or creator of the Appointment.
Subject	Look only in the Subject line of each item for the entered text.
Date	Searches for all Appointments scheduled for the specified time period. Combine two (or more) Date searches to get a list of Appointments scheduled to occur between a specific start and end date.
Location	Look only in the Location field of each item for the entered text.
Attendees	Look only in the Attendees field of each item for the entered text. For Appointments, the Attendees field is usually the equivalent of the To, Cc and Bcc fields, and contain the recipients of the Appointment or Meeting Request.
Attachment Name	Look only in the names of Appointment attachments for the EXACT phrase as entered.

Table 5. Search Parameter = Distribution List.

Entire Message	Look in all fields and all data contained in each item for the entered text. This is the default search scope, and is equivalent to the Basic Search mode.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
Owner	Look only in the Owner field of the item for the entered text.
Subject	Look only at the names of each Distribution List for the entered text.
Date	Searches for all Distribution Lists that were last modified during the specified time period. Dates must be entered in the YYYY-MM-DD format.
Members	Look only in the Members field of each item for the entered text. Matches are based on the individual members' email address as well as their First and Last Names.

Table 6. Search Parameter = Task.

Entire Message	Look in all fields and all data contained in each item for the entered text. This is the default search scope, and is equivalent to the Basic Search mode.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
Delegator (From)	Look only in the From field of each item for the entered text. For Tasks, the From field is usually equivalent to the originator of the Task, and is the sender or creator of the Task.
Subject	Look only in the Subject line of each item for the entered text.
Date	Searches for all Tasks scheduled to end at specified time period. Dates must be entered in the YYYY-MM-DD format.
Assignee (To)	Look only through the owners, of the Task for the entered text. For Tasks, the Owners are usually the equivalent of the To field of a Task Request, and are the ones who are responsible for, or have ownership of, the Task. Matches are based on the attendees' email address as well as their First and Last Names.
Attachment Name	Look only in the names of Task attachments for the EXACT phrase as entered.
Due Date	Searches for all Task due dates, modified dates, and completion dates based on the specified time period.
Body	Look only in the body of each Task for the entered text.
Subject/Body	Look only in the Subject line and the body of each Task for the entered text.

Table 7. Search Parameter = Contact.

Entire Message	Look in all fields and all data contained in each item for the entered text. This is the default search scope, and is equivalent to the Basic Search mode.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
Owner	Look only in the Owner field of the item for the entered text.
Name (Subject)	Look only in the Subject of the Contact item for the entered text. This is usually equivalent to the First and Last Names of the Contact.
Date	Searches for all items with a timestamp that matches the specified date range.
Address	Look only in the Address field of each Contact for the entered text.
Company	Look only in the Company field of each Contact for the entered text.
Email Address	Look only in the Email Address field of each Contact for the entered text.

Table 8. Search Parameter = Social Media.

Entire Message	Look in all fields and all data contained in each item for the entered text. This is the default search scope, and is equivalent to the Basic Search mode.
Entire Message (Phrase)	Look in all fields and all data contained in each item for the EXACT phrase as entered.
Site	Select a social media site from the drop-down list to search for all messages from the selected site.
User	Look only for the user who submitted the social media message.
Date	Searches for all items with a timestamp that matches the specified date range.