Search
Clear search
Close search
Google apps
Main menu

Using search operators

When you search in Google Vault, you can include search operators in the Terms field to narrow or broaden your search. Vault supports multiple operators, including:

  • Boolean operators (AND, OR, and NOT)
  • Gmail operators, such as to, cc, and bcc
  • Drive operators, such as type: and owner:
  • the wildcard operator (*). Use an asterisk at the end of a search term as a placeholder for unknown or wildcard terms. The wildcard operator is only supported at the end of a search term. For example, invit* returns both invitation and invite.

    Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Refine your search to make it more specific.
  • quotes to specify an exact phrase, such as "top secret widget".
  • the hyphen () to exclude whatever follows the hyphen. For example:
    • Use apples ‑bananas to retrieve messages that mention apples, but not messages that include both apples and bananas.
    • Use -in:trash to exclude files from Google Drive that are in the trash. 

Search operator conventions

When you use search operators, keep the following in mind:

  • Vault assumes there is an AND operator between search terms if no Boolean operator is specified.
  • If you use a Gmail search operator, make sure you include a colon (:) immediately after the operator. Also make sure there are no spaces between the operator and the value—for example, to:username1
  • When entering multiple values for the same operator, group them together in parentheses—for example, to:(username1 OR username2)
  • Enter dates using the format YYYY-MM-DD

List of search operators

Boolean operators

Be sure to enter Boolean operators in all capital letters; otherwise, they will be treated as search terms instead of operators.

Operator Description
AND Searches for results that include both the term before and the term after the operator. For example:
  • The query secret AND message returns all items that contain both the word secret and the word message.
  • The query from:username1 AND to:username2 returns all messages that were sent from username1 to username2.
OR Searches for results that include either the term before or the term after the operator (or both). For example:
  • The query secret OR message returns all items that contain either the word secret or the word message (or both).
  • The query from:(username1 OR username2) returns all messages that were sent from either username1 or username2.
NOT Searches for results that do not include the term after the operator. For example:
  • The query NOT secret returns all items that do not contain the word secret.
  • The query from:username1 NOT to:username2 returns all messages that were sent from username1 to anyone except username2.
Gmail-specific operators

These search operators apply only when searching for email messages.

 

Operator Description Example
from: The account that sent the message. from:username1
to: An account that received the message. The username can be in the To field or in the Cc field. The username can also be in the Bcc field in the account for which the Bcc is visible. to:username1
cc: An account that was Cc'd on the message. cc:username1
bcc: An account that was Bcc'd on the message. bcc:username1
replyto: The account specified as the intended recepient of any replies to a message. replyto:username1
subject: The subject of the message. If the subject includes spaces, substitute a dash (-) for each space. subject:secret-message
label: A label applied to the message. If the label name includes spaces, substitute a dash (-) for each space. The wildcard (*) is not supported.  label:urgent-requests
label:^deleted Deleted messages, which include messages that have been emptied from trash and messages removed by a retention policy. These messages are available for 30 days before they are expunged from all Google servers. label:^deleted
label:^admin_quarantine Messages that have been quarantined. Add a hyphen to exclude these messages from  your search. -label:^admin_quarantine
list: A group the message was sent from or to. list:company-announcements
listid: The unique identifier of a group the message was sent to. List-ID is a header included in messages sent to a group. You can view the List-ID header by opening a message and clicking original. listid:company-announcements.
solarmora.com
in:inbox Returns only messages that are in the inbox. in:inbox
in:spam Returns only messages that are in spam. in:spam
in:trash Returns only messages that are in trash. in:trash
is:chat Returns only chat messages. Email messages matching your search terms are excluded. is:chat
is:read Returns only messages that have been read. is:read
is:sent Returns only sent messages. is:sent
is:starred Returns only messages that have been starred by users. is:starred
is:unread Returns only messages that are unread. is:unread
deliveredto: An account the message was successfully delivered to. Excludes failed deliveries. deliveredto:username1
has:attachment Returns only messages that have at least one attachment. has:attachment
filename: Specifies the file name of the attachment. Supports partial matches and wildcard completion with the asterisk (*) character. Case insensitive. filename:file.pdf
filename:*.png
filename_exact: Specifies the exact file name of the attachment. Case sensitive. filename_exact:file.pdf
sent_before: Returns only messages sent before the specified date. sent_before:2010-12-16
sent_after: Returns only messages sent after the specified date. sent_after:2010-12-16
received_before: Returns only messages received before the specified date. received_before:2010-12-16
received_after: Returns only messages received after the specified date. received_after:2010-12-16

older_than

newer_than

Use relative periods of time to search for messages. You can use d, m, and y for day, month, and year.    newer_than:2d
attachmentid: Specifies the unique ID of an attachment. attachmentid:f_g9bxf1o90
size: The total size of a message in bytes, including attachments. In addition to a colon (:), you can use <, >, =, <=, and >= with this operator. size>100

larger:

smaller:

Similar to size: but allows abbreviations for numbers. larger:10M
rfc822msgid: A unique identifier for the entire message, added per RFC 822. If the application the message originated from did not add an ID, another server handling the message can add an ID as a way for client and server programs to keep track of the message. Message-ID is a header included in messages. You can view the Message-ID header by opening a message and clicking original. rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
Spjupgr1NZTiLGu16Z
@mail.solarmora.com

AROUND   

Syntax: "word1 AROUND <1-50> word2"

Returns messages that have a word (word1) within a specified number of words (1-50) of a second word (word2).

"don't AROUND 3 distribute"
Drive-specific operators

If you are searching for files on Google Drive, you can use the these search operators.

Option Description Example
owner:
from:
Documents owned or shared from a specific person. owner:username1
from:username1
to: Documents shared with a specific person. to:username1
is:starred Items that have been marked with a star. is:starred
in:trash Items that are in trash. in:trash
type:

Search by type of document, such as:

  • document
  • spreadsheet
  • presentation
  • pdf
  • image
  • video
  • drawing
  • form
  • table
type:spreadsheet
before:YYYY-MM-DD
after:YYYY-MM-DD
Find items that were edited before or after a certain day. before:2014-05-01
after:2014-05-01
title: Search by the item’s title. title:Conference 2014
Was this article helpful?
How can we improve it?