Advanced search


Every search requires a name. By default all admins have permission to access all searches. Non-admin users need to be granted specific permission to work with the search results. Permissions can be specified to allow access to a search but to disallow the non-admins ability to export or change to scope of the search.

Date range, tags, legal hold*, permissions, and a descriptive note are optional fields. Tags help you organize your system when you have many saved searches and the descriptive note will display in the list of all saved searches.

*Legal hold - The legal hold option allows to choose whether to display 1) All results 2) Only results on legal hold 3) Exclude results on legal hold. Note that this optional field can be used as the sole search criteria/condition.


In all searches, there's an "AND" relation between the search terms and the start/end dates.

In an advanced search, there's an implied "AND" between fields and between terms in the "has words" and "doesn't have words" fields. There's an implied "OR" between words in the other text fields, and between the checkboxes for "message body" and "attachments" when both are checked.

NOTE: If the terms or phrase you are searching for contains a ":" you need to include the search terms or phrase between quotation marks ("..."). For instance, if you are looking for the terms/phrase the broker did the following: then, you would have to write in the search terms field: "the broker did the following:"

Wildcard query operators:

You can use wildcard operators to locate messages and/or documents based on partial terms.  You can use the asterisk ( * ) operator to locate messages and/or documents that contain specified partial terms.  For example:
             contract* - Denotes any term that begins with “contract” (such as “contract”, “contracted”, or “contracts”).
            *@acme* - Denotes any term that contains the strings “@acme” (such as “ or
            43931* - Denotes any term that starts with the sequence “43931” (such as “43931.00” or 43931226).
You can use the question mark (?) operator to locate messages that contain a specified term, with a given character replaced.  For example:
            “???? ???? ???? ????”- Denotes any term that contains four sets consisting of four characters each with a single space between sets (4417 1234 5678 9012, a common format for credit/debit card numbers”).

            “???\-??\-????” - Denotes any term that contains a set of three characters, followed by a dash, followed by two characters, followed by a dash, followed by three characters (i.e. 123-45-6789, a common format for U.S. social security numbers). See the section below “Searching for Terms that Contain Reserved Characters” for the explanation of “/” use.

            ?inks - Denotes any term that contains any character proceeded by the string “inks” (such as “links” and “rinks”).
            “well gra?e?” - Denotes any phrase beginning with the term “well” followed by a space and then a term that contains the string “gra”, followed by any character, followed by the letter ‘e’, followed by any character (such as “well graded” and “well grates”).

NOTE ON WILDCARDS (*): Wildcards can be used with any kind of words or number as long as they contain at least 5 characters or numbers. Using wildcards on words will less than 5 characters or strings with less than 5 numbers won't be effective.

NOTE ON LEADING WILDCARDS (*): Leading wildcard query operators can only be used for the following search fields: Subject, Sender, Recipients, Attachment name, and Mailbox. Leading wildcard query operators cannot be used for the following fields: Has words and Do not have words.


An Advanced search features additional fields and the ability for you to enter custom criteria separated by a comma delimiter that expands upon the Simple Search basic criteria. Use advanced searching to scope the search by user, subject, size, and attachment name.

Subject: Enter text (search terms) to find messages with specific terms in the subject line.

Include: Select E-mail, Lync IMs, or both for inclusion in the search (if Lync instant messages are enabled).

Sender: Enter a full or partial email address to find messages from a specific sending address.
Some examples:
Specific user:
All users at a specific organization: *
Some users with "smith" in the address: ?

To/cc/bcc: Use full or partial email addresses separated by spaces to find messages sent to specific addresses.
To search for a specific address and not show messages with

Has words: Enter text to find messages with specific search terms. Apply the search to message body, attachment or both.

Doesn't have words: Use this field to limit search results to items that do not have specific terms. An example would be to keep a repeating message from appearing in the results list if the message contains a search hit but is not the desired result.

Attachment name: The index can find messages by attachment name. For example enter expense.xls to find all messages with the file expense.xls attached.

Once you are done populating the name, date range, and one or more search options field(s), click on Save and display results to save your search and access your search results; or click on Save and return to list to save your search and return to the SAVED SEARCHES page with all the previously created searches.

Screenshot - Advanced search