Use operators to refine a search in Vault

You can include search operators in the Terms field to narrow or broaden your search.

Before you begin

  • All search operators must be entered in English, even if people in your organization use other languages to communicate. You can use English search operators to find non-English words and phrases.

  • Vault assumes there is an AND operator between search terms if no Boolean operator is specified.

  • When you use an account name to search for messages or files, always include a colon (:) with no spaces immediately after the operator—for example, to:username1 in Gmail and owner:username2 in Drive. 
  • When entering multiple values for the same operator, group them together in parentheses—for example, to:(username1 OR username2)
  • Vault can search for words and numbers. You can't search for punctuation marks or symbols.
Use search operators to find Gmail, classic Hangouts, and Groups messages

Find messages that include 2 given search terms. 

AND

Examples:

  • secret AND project
  • from:username1 AND to:username2

Find messages that include either of 2 given search terms (or both).

OR

Examples:

  • secret OR confidential
  • from:(username1 OR username2)

Find messages that do not include a given search term. 

NOT

Examples:

  • NOT personal
  • from:username1 NOT to:username2

Find unknown or wildcard terms. 

*

Examples: 

  • invit*
  • from:*@ink-42.com

The wildcard (*) must appear at the end of a search term. For example,  invit* returns messages with either invite or invitation (or both). However, *ation isn't supported. 

You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain.

Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific.

Find messages sent by a given account.

from:

Example:

  • from:username1

Find messages received by a given account.

to:

Examples:

  • to:username1
  • to:finance-team@solarmora.com

Vault returns any messages that include the username in the to, cc, or bcc fields.

Can also be used to search for group email addresses.

Find messages where the given account is included in the cc field.

cc:

Example:

cc:username1

Find messages where the given account is included in the bcc field.

bcc:

Example: 

  • bcc:username1

Find messages where the given account is specified as the intended recipient of any replies.

replyto:

Example: 

  • replyto:username1

Find messages with a given subject.

subject:

Example: 

  • subject:secret-product-launch-plans

To search for multiple-word subjects, substitute a hyphen (-) for each space.

Find messages with a given Gmail label. 

label:

Example: 

  • label:purchase-orders/approved

If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels. 

Note: searching for system-generated labels may return an excessive number of messages.

Find or exclude messages that have been removed from users' trash but haven't yet been expunged.

label:^deleted

-label:^deleted

Find or exclude messages that have been removed from user mailboxes because a retention rule expired.

label:^vault_deletion

-label:^vault_deletion

Find or exclude messages that have been quarantined

label:^admin_quarantine

-label:^admin_quarantine

Find or exclude messages sent with Gmail confidential mode

label:confidentialmode

-label:confidentialmode

Find messages sent to or from a group.

list:

Example: 

  • list:company-announcements

Find a message based on the unique identifier of the group the message was sent to.

listid:

Example: 

  • listid:employee-announcements.solarmora.com

List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and then click Original in the upper-right corner.

Find messages that are in a given folder.

in:inbox

in:spam

in:trash

Limit search results to classic Hangouts messages only (excludes Gmail messages).

is:chat

Find messages based on their status.

is:read

is:sent

is:starred

is:unread

Limit search results to messages that were successfully delivered to accounts.

deliveredto:

Example: 

  • deliveredto:username1

Find only messages that have at least one attachment.

has:attachment

Find messages that include attachments with a given file name.

filename:

Example: 

  • filename:secret-plans.pdf

This search term is case insensitive and supports partial matches and wildcards.

Find messages that include attachments with the exact file name you specify.

filename_exact:

Example:

  • filename_exact:sEcReT-PlAnS.PdF

This search term is case sensitive.

Find message based on when they were sent or received.

sent_before:

sent_after:

received_before:

received_after:

Example: 

  • sent_after:2017-12-16

Find messages older or newer than a given period of time.

older_than:

newer_than:

Example: 

  • newer_than:1m

Supported periods of time include d (day), m (month), and y (year).

Find messages with a given attachment ID.

attachmentid:

Example: 

  • attachmentid:f_g9bxf1o90

Find messages based on their size in bytes, including any attachments.

size:

Example: 

  • size>=1000000

You can use :,<, >, =, <=, and >= with this operator.

Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments.

smaller:

larger:

Example: 

  • larger:10M

Use K for kilobytes and M for megabytes.

Find messages based on a Message-ID.

rfc822msgid:

Example: 

  • rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
    Spjupgr1NZTiLGu16Z@mail.solarmora.com

Message-ID is a unique identifier for a message, added added by mail servers. Email clients and servers use this identifier to keep track of a message. You can view the Message-ID header by opening a message in Vault and clicking original.

Find messages with words near each other.

AROUND

Example: 

  • tax AROUND 10 audit
  • "secret AROUND 25 project"

Use the number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word.

This term can't be combined with a wildcard search and can't be used with parentheses or multiple-word phrases.

Use search operators to find files in Drive

Find files that include 2 given search terms. 

AND

  • Example: secret AND project
  • Example: owner:username1 AND to:username2

Find files that include either of 2 given search terms (or both).

OR

  • Example: secret OR confidential
  • Example: type:(spreadsheet OR pdf)

Find files that do not include a given search term. 

NOT

  • Example: NOT personal
  • Example: username1 NOT type:image

Find files owned by a given account.

owner:

  • Example: owner:username1

Find files shared by a given account.

from:

  • Example: from:username2

Find files shared with a given account.

to:

  • Example: to:admin@solarmora.com

Find files that users have marked with a star.

is:starred

Find or exclude files that users have moved to trash.

in:trash

-in:trash

Find a given file type.

type:

  • Example: type:presentation

Supported file types:

  • textdoc (Google Docs)
  • spreadsheet (Google Sheets)
  • presentation (Google Slides)
  • drawing (Google Drawings)
  • form (Google Forms)
  • jam (Jamboard files)
  • site (new Google Sites)
  • document (all Google file types and PDFs)
  • pdf
  • image
  • video

Find files based on when they were edited.

before:

after:

  • Example: before:2017-12-31

Find files based on their title.

title:

  • Example: ​title:secret product launch plans
Use search operators to find Hangouts Chat messages

Note: Hangouts Chat doesn't support Boolean operators or terms that are enclosed in quotes.

Find direct messages sent by a user and threads the user participated in.

from:

  • Example: from:jane@solarmora.com

You must include the full account name, including the domain.

Find threads and messages that include a specific type of content.

has:

  • Example: has:video

Supported content types:

  • file
  • doc
  • sheet
  • slide
  • url
  • video
  • pdf
  • image

Find threads that mention a given user. 

at:

  • Example: at:jack@solarmora.com

You must include the full account name, including your organization's domain.

Find message threads based on when they were sent or updated.

before:

after:

  • Example: after:2018/11/21
  • Example: before:2019/03/16 tz:GMT-08:00

Dates are exclusive. UTC is used unless you use the tz: operator to specify a time zone.

Find messages older or newer than a given period of time.

older_than

newer_than

  • Example: older_than:1y

Supported periods of time include d (day), m (month), and y (year).

UTC is used unless you use the tz: operator to specify a time zone.

Specify a time zone for date- and time-based searches.  

tz:

  • Example: tz:GMT-05:30

Specify the time zone with GMT+ or GMT- and the offset from UTC.

Search only direct messages or only messages in chat rooms.

is:

  • Example: is:dm
  • Example: is:room

Find messages that match one or more keywords.

+

  • Example: +secret +project

Matches each keyword exactly. For example, a search that includes +tax won't return messages that mention taxes.

Exclude messages that contain one or more keywords.

-

  • Example: -personal

Matches each keyword exactly. For example,  a search that includes -finance will return messages that mention finances.

Was this helpful?
How can we improve it?