Advanced Query Language Fields

Field Description Type Example

altrecipients

Alternative recipients listed in the To field or Cc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

altrecipients:
bob_anderson@
genericorp.com

attachedfiles

A filename (If filename contains spaces, enclose in quotes)

Filenames joined by Boolean expressions (If filename contains spaces, enclose in quotes)

To match an ordered list of attachments use a semicolon separated list of all filenames, enclosed in quotes (No need to add extra quotes to filenames with spaces)

String

attachedfiles: picture.jpg

attachedfiles: picture.jpg or “second picture.jpg”

attachedfiles:
“report.xls; report.doc; Quarterly Report.ppt”

content

The content of the message.

String

content:”Q4 results”

dlists

Distribution lists listed in the To field or Cc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

dlists:
all_employees@
genericorp.com

emaildate

The date specified in the Sent Date field of the message header.

To search by date only, use the form YYYY-MM-DD.

To search by date and time, use the form YYYY-MM-DDThh:mm:ssZ.

T is a required constant that identifies the following characters as times.

Z is an optional UTC (Coordinated Universal Time) time zone identifier. UTC is default.

Use 24-hour clock when specifying time.

Use min and/or max to specify earliest/latest dates.

Use < or > to specify dates before or after a certain date.

Note: By default, emaildate is stored as UTC (GMT) time. To search using your local time zone value, use the TIME value to manually compensate for the number of hours offset from UTC. For example: T05:00:00 is midnight in the US-Central time zone.

Date

To find messages sent between January 1, 2018, midnight (local) and January 3, 2019, midnight (local): emaildate:range (2018‑01‑01T05:00:00, 2019‑01‑03T05:00:00)

To find messages received after Aug. 21, 2019 use:
emaildate:>2019-08-21

To find messages received before Aug. 21, 2019, use:
emaildate:<2019-08-21

envrecipients

The recipient information contained in the message envelope. Note that the message envelope refers to the wrapper that contains the message's delivery directives.

  • For envelope journaled messages: This field contains all recipient information.
  • For non-journaled messages: This field can be used to search for Bcc recipients.

NOTE: Only email addresses found in retention policies can be found using Bcc. It will not find any email addresses that are external to your organization or not included in a retention policy.

String

envrecipients:
bob_anderson@
genericorp.com

envsender

The sender information contained in the message envelope.

Note that the message envelope refers to the wrapper that contains the message's delivery directives.

String

envsender:bob_
anderson@
genericorp.com

filename

The file name of a document or message.

When searching for an attachment, also set isattachment:1 for the attachment file name.

To search for a message, set isattachment:0.

String

filename:report.xls and isattachment:1

isattachment

An indicator of whether the document is an email attachment or a message.

To indicate that the document is an attachment, set isattachment:1.

To indicate that the document is not an attachment, set isattachment:0.

Integer

filename:report.xls and isattachment:1

mailbcc

Recipients listed in the Bcc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailbcc:
bob_anderson@
genericorp.com

mailbccaltrecipient

Alternative recipients listed in the Bcc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailbccaltrecipient:
bob_anderson@
genericorp.com

mailbccdlist

Distribution lists listed in the Bcc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailbccdlist:
all_employees@
genericorp.com

mailcc

The recipients listed in the Cc field of the message header.

String

mailcc:bob@
genericorp.com

mailccaltrecipient

Alternative recipients listed in the Cc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailccaltrecipient:
bob_anderson@
genericorp.com

mailccdlist

Distribution lists listed in the Cc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailccdlist:
all_employees@
genericorp.com

mailfrom

The sender listed in the From field of the message header.

String

mailfrom:bob@
genericorp.com

mailsubject

The subject of the message.

If value contains spaces, enclose in double-quotes.

String

mailsubject:
”Quarterly Report”

mailto

The recipients listed in the To field of the message header.

String

mailto:
bob@genericorp.com

mailtoaltrecipient

Alternative recipients listed in the To field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailtoaltrecipient:
bob_anderson@
genericorp.com

mailtodlist

Distribution lists recipients listed in the To field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

mailtodlist:
all_employees@
genericorp.com

receiveddate

The date the message was received by the email server.

To search by date only, use the form YYYY-MM-DD.

To search by date and time, use the form YYYY-MM-DDThh:mm:ssZ.

T is a required constant that identifies the following characters as times.

Z is an optional UTC time zone identifier. UTC is default.

Use 24-hour clock when specifying time.

Use min and/or max to specify earliest/latest dates.

Note: By default, receivedate is stored as UTC (GMT) time. To search using your local time zone value, use the TIME value to manually compensate for the number of hours offset from UTC. For example: T05:00:00 is midnight in the US-Central time zone.

Date

To find all messages received on or after February 3, 2018, use receiveddate:range (2018-02-03, max).

To find all messages received before February 3, 2018, use receiveddate:range (min, 2018-02-03)

recipients

The recipients listed in one or more of the following:

  • The list of recipient information contained in the message envelope (see envrecipient field for details)
  • The To field of the message header.
  • The Cc field of the message header.
  • Distribution lists listed in the To field or Cc field of envelope journal report. Note that this search field is only applicable to envelope journaled messages.
  • Alternative recipients listed in the To field or Cc field of envelope journal report. Note that this search field is only applicable to envelope journaled messages.

String

(recipients:bob@
genericorp.com OR recipients:sue@
genericorp.com)

senders

The list of senders in the message envelope or the From field of the message header.

Note that the message envelope refers to the wrapper that contains the message's delivery directives.

String

(senders:bob@
genericorp.com OR senders:sue@
genericorp.com)

size

The size of document (message or attachment) in bytes.

Express sizes in bytes. For example, 4 KB as 4096.

Use < or > to specify sizes greater or less than a certain size.

Integer

To find all messages (messages only, without attachments) with a total size of at least 4KB but no greater than 8KB, use size:range (4096, 8192)

totalsize

The size of the message, in bytes, including all attachments.

Express sizes in bytes. For example, 4 KB as 4096.

Or use < or > to specify sizes greater or less than a certain size.

Integer

To find all messages with a total size (messages and attachments) of at least 8KB or greater, use totalsize:range (8192, max)

undisclosedrecipients

Undisclosed recipients listed in one or more of the following:

  • The list of recipients in the Bcc field of the envelope journal report.
  • The list of distribution lists in the Bcc field of the envelope journal report.
  • The list of alternative recipients in the Bcc field of the envelope journal report.

Note that this search field is only applicable to envelope journaled messages.

String

undisclosedrecipients:
bob_anderson@
genericorp.com