• Enter words with a space between words.
• Stemming does apply (see Stemming), as does the implied wildcard (*) at the end of each word.
• Stop words do apply. See Stop Words
• Double-quotes are ignored.
• Multiple search terms are AND’d together, then AND’d with the other search fields.

Enter keywords into the field with a space between words.

• Neither stemming or stop words apply, and this field does not add the implied wildcard (*) at the end of words.
• Double-quotes are ignored.
• The contents of the field are OR’d together, and the result is then AND’d with the other search fields.
• If any of the keywords contain multiple words, separate each keyword with a comma, instead of a space.

Example: The search term: apple, pumpkin, lemon meringue
searches for three terms: “apple”, “pumpkin” or “lemon meringue”

Enter one phrase.

• Double-quotes are not needed.
• Neither stemming or stop words apply, and this field does not add the implied wildcard at the end of words.
• The results of this field are AND’d with the other search terms.
• The Archive’s search index is based on whole words or tokens, not partial words or individual letters/numbers.

For example: The search term mail would not return documents containing the term gmail.

For example: The search term company would match person@company.com, but not person@newcompany.com.

Filters results based on whether the recipient information in the message envelope or in the TO and CC fields in the message header contains the value you provide. Limitations on envelope searches, as described in the Recipients (Envelope) entry in Company Query Builder, also apply to this filter.

Use this field to filter the query by dates. The email date used for this query is the date the Exchange Server received the email message.

The query can be created to search on, after, or before a defined date, or between two defined dates. The after, before and between searches can also include time values. A date with 24-hour time is used, in the format: MM/DD/YYYY HH:MM.

The Involved Users query field is different than Sender or Recipients fields. Sender and Recipients are keyword searches of the character string, and refer to any email address whether they are part of the AMS system or not. Involved Users are only AMS system mailboxes.

Involved Users are defined by selecting Mailing Lists, User Sets, Email Servers, or individual users from a user selection pane. Involved Users can also be uploaded from a CSV file.

When the Involved Users row is added to the list of query fields:

1. Click the Select Users button.
2. Click one of the user selection tabs (User Sets, Servers, Mailing Lists, or Users).
3. Select the users to add.
4. Click the Add button between the two columns. The items you selected are added to the Users in the Set pane.
5. Repeat until all user sets, servers, mailing lists, and individual users that are to be included in the search are displayed in the Users in the Set pane.
6. Click Submit to add all the users in the list to the query and return to the search window.
7. The selected items will be listed in the Involved Users field beside the Select Users button.

The Tagged search filter is located in the Other Fields drop-down allows Reviewers to search for messages that have been tagged with a certain value.

See Message Tagging for more information on how to tag messages and what can be done with them.

When Tags are created, they are defined within the context of a specific Reviewer Group. So, when searching for tagged emails, ensure the Reviewer Group scope is properly set by first clicking the Reset button to clear all the search fields.

1. Click on the Reviewer Scope drop-down and select the Reviewer Group that contains the Tag that is being search for.
2. When the Tagged With row is added to the list of query fields, click the Tagged drop-down to display the list of available tags.
3. Select the desired Tag from the drop-down list. Only one Tagged With value can be searched for in each search.
4. If desired, select other search terms.
5. Click the Search button to execute the search.

The Sampling Policy filter is located in the Other Fields drop-down. When this Sampling Policy filter is included in a Reviewer query, all other terms in the query are executed first, and then a random sample of the resulting emails is returned to the user.

• The Sampling Policy filter has the options of: 1/100, 1/1,000, 1/10,000, and 1/100,000 of the total number of messages returned by the other terms in the query.
• The actual number of messages returned by the Sampling Policy filter depends on which individual messages are selected by the sampling algorithm. Generally, the expected number of messages will be returned by the Sampling Filter. But due to the design of the sampling algorithm, it is possible that no messages will be returned if no item was sampled by the algorithm, or more than the expected number of messages will be returned if those items are selected by the algorithm.
• Queries using a Sampling Policy filter are reproducible. Entering the exact same search query will produce the same sample set.
• The Sampling Policy filter can be added to the query in any order, and is always evaluated last.

Filters results based on whether the From field in the message envelope contains or does not contain the value provided.

Filters results based on whether the From field in the message header contains or does not contain the value provided.

Filters results based on whether the recipient information in the message envelope contains or does not contain the value provided.

For non-journaled messages: This filter can be used to search for Bcc recipients.

NOTE: Only email addresses found in retention policies can be found using this option. It will not find any email addresses that are external to your organization or not subject to a retention policy.

Filters results based on whether the To field in the message header contains or does not contain the value provided.

Filters results based on whether the Cc field in the message header contains or does not contain the value provided.

Filters results based on whether the total size of the message and its attachments in bytes is (exactly), is not (exactly), is less than, or is greater than the value provided.

Filters results based on whether the name of the attachment contains the value provided.

The value is not case sensitive and adds an implied wildcard.