Use Vault to search Google Calendar

Google Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin must set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search for Calendar events, such as regular events, out of office events, focus time, and booked appointment schedules.

What to know before you search

Before you search for events, review the Calendar events supported in Vault and the Vault Search FAQ.

Expand section  |  Collapse all & go to top

What data is searched

For all events, you can search for title, description, location, attendees, or rooms. You can't search for for a hyperlinked Drive file by its name or content.

Searched:

• Primary calendar events
• Out of office events
• Booked appointments
• Focus time

Not searched:

• Secondary calendar data, such as holiday or group calendars
• Tasks
• Working location
• Unbooked appointments

For details, go to Supported services and data types.

Search within the revision history of an event

If you search for an event, Vault returns the most recent version unless you enter a version date as part of your search. If you enter a version date, Vault returns the last available version before 12:00 AM UTC on that date. If you add filters, Vault applies the filters to the current event versions, then returns versioned data for these events.

When you set up a Calendar retention policy, be aware of the following points:

• If you don't set up a Calendar retention policy, revision information is kept for 30 days.
• When you create a Calendar retention rule for an organization, all Calendar events retain a maximum of 365 revisions.
• The last revision of the day is kept, and previous revisions for that day are discarded.
• When a user is placed on hold, all of their revisions are retained for the duration of the hold. After the hold is lifted, all revisions after revision number 365 are deleted.
• If you enter a version date and search for an event that is part of a series, the search returns the entire series. This result occurs because some revisions, such as changing the frequency of an event series, do not relate to a specific event instance.

Search & export an event series

If you search for an event series, and you enter a parameter, the part of the event series that matches the parameter is returned. For example, if you search for an event series with a date parameter, you get the part of the series that matches that date.

For export, however, you get the entire series. An event series is represented as a single entry in the Internet Calendar Scheduling (ICS) file. You can use this format to import the data into third-party tools.

About client-side encrypted event descriptions

Vault displays and holds client-side encrypted events in the same way as other events.

You can preview the unencrypted event information, such as the event title, attendees, and location.

You cannot search for or preview encrypted event descriptions. To view encrypted content, export the data and decrypt it using the decrypter utility (beta).

Search for events in Calendar

You use matters to search data. Matters are workspaces for your Vault projects and they allow you to group together related holds, searches, and exports. Matters don't restrict the data you can search. All data that you're allowed to access is searchable from any matter.

1. Sign in to vault.google.com.
2. If you have created a matter, click Mattersyour matter.

   Otherwise, create a matter. For details, go to Create and manage matters.

3. Click Choose serviceCalendar.
4. Select the source data to search:
   • All data—Search all events in your organization
   • Held data—Search events on hold for the matter
5. Select the entity to search:
   • Specific accounts—Enter up to 5,000 email addresses
   • Organizational unit—Search accounts in a specific organizational unit

     If the organizational unit has child organizational units, accounts in the parent and child are searched.

6. Select a time zone.

   For details, go to How does Vault handle time zones and daylight saving time?

7. Choose a date range:
   • All events up to now—Searches all events (default)
   • Custom date range—Searches for events between a start and end date
8. (Optional) To enter search terms, click Terms and enter one or more search terms.

   For details, go to Search terms for Calendar events (later on this page).

9. (Optional) To use advanced search options (for example, search by guest, room, or response status), click Advanced options and enter your search options.

   For details, go to Search terms for Calendar events (later on this page).

10. (Optional), To run the search and return a list of events that match your query, click Search.

    For details, go to Review search results (later on this page).

11. (Optional) To export the search results and skip the search results preview, click Export.

    For more information, go to Export data from Vault.

Search terms for Calendar events

Expand section  |  Collapse all & go to top

Calendar search terms

When you search a Vault matter for Calendar events, you can enter up to 2,000 characters. Wildcards and search operators are not supported.

For example, to search for:

• Keywords (event's title, description, guests, organizer, locations, or rooms)—Enter words separated by a space.

  Example: Daily Sync (the search matches events that contain both "daily" and "sync")

• A phrase—Put the phrase in quotation marks.

  Example: "Company all hands"

Example: Find guests

To search for the creator, organizer, or guests, enter one or more usernames separated by spaces. 

Example: [e-mail] [e-mail]

Example: Find future events

To search for future events, click Custom date range and leave the end date blank or use a date in the future.

Example: Find events that have a specific response status from guests

You can search for events where guests responded that they were, were not, or maybe attending or gave no response status. You specify the guests in the Entity field.

When you search, use the following parameters:

1. For the source data, select All data.
2. (Optional) To refine your search, add terms such as the following:
   • To find events during a period, click Custom date range and enter the start and end dates.
   • To find events with specific keywords, click Terms and add keywords.
3. Click Advanced options, then for Response status, select the response status you want to return.

   To view events with any response, uncheck all boxes.

Review search results

When your search completes, click the event title to open a preview of the event:

• Events with have one or more hyperlinked Drive files. To access the hyperlinked Drive file, click the event to get a Drive link, then click the link to access the file in Drive.

  Whether you can access the hyperlinked Drive file depends on your assigned permission for the file.

• Events with have client-side encryption.

  For more information, go to About client-side encrypted event descriptions (earlier on this page).

To view the guest list, click the event. If the event has more than 200 attendees, export the event to view the attendees. For more information, go to Export data from Vault.

You can also:

• Edit your search–Click Edit query, edit the search query, and click Search.
• Save your query–Click Save.

  For details, go to Save search queries in Vault.

• Clear all fields and start a new search–Click Clear.
• Create an export of your search results–Click Export.

  For details, go to Export data from Vault.