Search <book_title>...

Arctera™ Insight eDiscovery Help

Last Published: 2025-10-13

Product(s): Veritas Alta Archiving (1.0), Veritas Alta eDiscovery (1.0)

Search examples and tips

Examples of using Basic, Advanced, and Query Searches

Suppose you want to search for the messages that relate to the resetting of a password. You can enter password reset into the Search box and click Search to perform a Search. The space between password and reset is treated as an AND operator, so the returned results contain any messages that include both the word password and the word reset.

Suppose that you now decide to search for the phrase password reset, and to exclude from the results any emails that reference the word Box. You can use an Advanced Search for this purpose. Click the expand icon to display the Advanced Search options. Your original Search is now shown in the first criteria row.

Insert double quotation marks around password reset to specify it as a phrase. Then click + to add a second criteria row. In the new criteria row, select Doesn't Contain and enter Box in the text field.

Click Search to perform the search. The search returns any items that do not contain Box but that contain the exact phrase password reset.

Table: List of query search terms lists some possible query search terms along with examples.

Table: List of query search terms

Search term	Data type	Description	Example
_All, Entiremessage	Text	Searches through all default fields. Add search criterion before query text/value.	_All:(test or test2) "hello world" Entiremessage:test
Attachments.content	Text	Search by attachment content.	Attachments.content: "Hello World"
Attachments.extension	Text	Search by attachment file type (PDF, DOC, docx, and so on.)	Attachments.extension:docx
Attachments.filename	Text	Search by the file name of the attachment.	Attachments.filename:Report.PDF
Attcount	Integer	Search by the amount of attachments. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Attcount:6
Attflag	Boolean	Search by whether there is an attachment.	Attflag:true
Atttext	Text	Search the content of the attachments.	Atttext:Computers
Atttypes	Text	Search by the attachment type.	Atttypes:PDF
Bcc	Text	Search by blind carbon copy recipients.	Bcc:JoeBlogs@example.com Sender:*@example.com
Cc	Text	Search by carbon copy recipients. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Cc:JoeBlogs@example.com Sender:*@example.com
Classification.tags	Text	Search by classification tags. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Classification.tags:PII
FromOrTo	Text	Search the text in the From and/or To fields of the email.	FromOrTo:JoeBlogs@example.com
Hidden	Boolean	Search whether email is visible to end user or not. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Email Hidden: Hidden:(1) Email Visible: NOT Hidden:(1)
Inbound	Boolean	Search inbound emails. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Inbound:false
Internal		Search and retrieves only internal messages exchanged within the same organization. Note: This query search term does not support the Searches for the Microsoft Teams messages.	To include internal emails, use: Internal:(3). To exclude internal emails, use: NOT Internal:(3).
Ipheader	IP Address	Search by the IP header of the email. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Specific IP Address: Ipheader:(10.201.1.1) IP Address using wildcards: Ipheader:(10.*.1.1) AND Ipheader:(10.201.?.1)
MailDate	Date Time	Search by the date the message was sent.	Closed Range: MailDate: [2018-01-01T00:00:00 TO 2019-12-31T23:59:59] Open Range: MailDate: {2018-01-01T00:00:00 TO 2019-12-31T23:59:59}
Messagesizeinkb	Floating Point Number	Search by total size of the email. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Messagesizeinkb:[2.5 TO 5]
Outbound	Boolean	Search whether a user sent the email. Note: This query search term does not support the Searches for the Microsoft Teams messages.	Outbound:true
Sender	Text	Search by the sender address(es).	Sender:JoeBlogs@example.com Sender:*@example.com
Subject	Text	Search by the subject of the email.	Subject:IT
SubjectBody	Text	Search the text in the subject of emails and/or in the content of the email.	SubjectBody:Test
Textbody	Text	Search the text content of the email.	Textbody: "Hello World!"
To	Text	Search by recipient.	To:JoeBlogs@example.com To:*@example.com

Examples of Query Searches:

Sourcetype:"Exchange"
SourceType:{"Exchange" OR "Citrix"}
MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00]
Messagesizeinkb:[0.0 TO 11.5]
Subject:(export OR report)
MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00] AND subject:archive
Sender:(*@domain.com OR *@domain2.com OR *@domain3.com)
Atttypes:(pdf OR docx) AND atttext:process
Attachments.filename:(Report.PDF or Export.docx)

Searching the From, To, BCC and CC fields

The To, From, and From/To search options are available within an Advanced Search.

The To option provides search results from the To, BCC, and CC fields.
The From option provides search results from the From field.
The From/To option provides search results from the From and To fields.

Searching within specific email domains

One way to search for items within a specific domain is to enter the domain name in the To field of an Advanced Search.

You can use wildcards to search for results from a group of similar domains. For example mycloud* returns emails for the domains that begin with mycloud.