It seems like your browser didn't download the required fonts. Please revise your security settings and try again.

Keyword Expressions

  • Last updated on

Video

Watch this TechLib Video for a short walkthrough of searching with keyword expressions:

Keyword expressions allow you to construct your own complex queries in Advanced Search, letting you combine multiple keyword-based search terms that follow this basic syntax: search_field:phrase . For example, to search for all messages containing "Alert" or "Notification" anywhere in the Subject field.

  1. Click the Basic > Search tab, and then click Advanced.
  2. Select Email as the item type, and then select Keyword Expression as the parameter.
  3. In the text field, type: subject:"Alert" OR "Notification".
  4. Click Search to return all matching search results.

Table 1. Commonly used search_field values.

 

TermDescriptionSearch Type
to Search is limited to the To and Cc fields of each messageText
from Search is limited to the From field of each messageText
domain Search is limited to the domain names in the From, To, and Cc fields of each messageDomain
subject Search is limited to the Subject line of each messageText
bodySearches are performed in the Body of each message as well as in the contents of any message attachmentsText
attachment Search is limited to the contents of message attachmentsText
all Searches all fields and all data contained in each messageText
stored_sizeThe actual message size on diskInteger number
sizeThe raw size of the messageInteger number
header_dateThe date header from the mail Text
header_barracuda_envelope_rcpt_pretty_nameThe envelope recipient's pretty name Text
header_barracuda_envelope_rcpt_user The envelope recipient Text
header_bccThe Bcc: headerText
header_to The To: header Text
header_in_reply_to The In reply to: header Text
header_barracuda_envelope_rcpt_domainThe domain of the envelope recipient Text
header_from The From: header Text
header_barracuda_envelope_rcpt_message_mode Inbound / Outbound / InternalText
header_barracuda_envelope_rcpt_addrEmail address of envelope recipient Text
header_subjectSubject of the email Text
header_message_idThe message ID header Text
object_typeType of entry (calendar, mail, etc.) Text
body_excerpt The body of the email Text
attachment_nameThe attachment name Text
attachment_mimetype The attachment MIME typeText
attachment_extensionThe attachment's extension Text

You may specify other search_field values as long as the correct name for the field is used. Consult Barracuda Networks Technical Support if you are unsure of the exact syntax.

The phrase can only contain a single item. However, that one item can be any one of the following:

  • a single Text-based string;
  • a single Integer number-based string;
  • a single Wildcarded string;
  • a single Domain-based string (for to and from search_field only);
  • a single compound search string created by combining multiple strings with the keywords AND and OR, and grouping the phrases with parentheses to control the logic.

    Important

    When creating compound search strings, the keywords 'AND' and 'OR' must be capitalized.

Table 2. Sample keyword expressions.

to:chrisleeAll messages that have "chrislee" in the To or Cc fields.
to:patbrown@mycompany.comAll messages containing "patbrown@mycompany.com" anywhere in the To field.
to:chrislee AND NOT to:patbrownAll message that have "chrislee" and does not have "patbrown" in the To field.
to:chrislee AND !to:patbrownAll message that have "chrislee" and does not have "patbrown" in the To field.
subject:"Barracuda Message Archiver"All messages that contain the exact phrase "Barracuda Message Archiver" anywhere in the Subject line.
domain:(barracuda.com OR barracudanetworks.com)All messages that were sent to or from any user in either the "barracuda.com" or "barracudanetworks.com" domain.
header_barracuda_envelope_rcpt_domain:sub.mycompany.comAll messages sent to any user in the @sub.mycompany.com domain.

Proximity Syntax Form

For the keyword proximity syntax form, each keyword must be in a single Text-based string. Enter the keyword proximity syntax as search_field:"keyword keyword"~NumericValue, where search_field is the part of the email to search through.

Table 3. Sample proximity syntax.

subject:"release Barracuda"~4 All messages containing "release" and "Barracuda" in the Subject field within four words of each other.
to:"Zac Britt"~4 All messages containing "Zac" and "Britt" anywhere in the To field within four words of each other.

Fuzzy Search Syntax Form

Fuzzy search allows you to find words that are similar to a specified search term. For the fuzzy search syntax, enter a single keyword followed by the tilde (~). For the fuzzy search syntax form, the keyword must be in a single Text-based string.

Table 4. Sample fuzzy search syntax.

roam~ All messages containing words similar to roam, for example, foam, roams.