Use operators to refine a search in Vault

Find messages that include 2 given search terms. 

AND

Examples:

• secret AND project
• from:username1 AND to:username2

Find messages that include either of 2 given search terms (or both).

OR

Examples:

• secret OR confidential
• from:(username1 OR username2)

Find messages that do not include a given search term. 

NOT

Examples:

• NOT personal
• from:username1 NOT to:username2

Find unknown or wildcard terms. 

*

Examples: 

• invit*
• from:*@ink-42.com

The wildcard (*) must appear at the end of a search term. For example,  invit* returns messages with either invite or invitation (or both). However, *ation isn't supported. 

You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain.

Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific.

Find messages sent by a given account.

from:

Example:

• from:username1

Find messages received by a given account.

to:

Examples:

• to:username1
• to:finance-team@solarmora.com

Vault returns any messages that include the username in the to, cc, or bcc fields.

Can also be used to search for group email addresses.

Find messages where the given account is included in the cc field.

cc:

Example:

cc:username1

Find messages where the given account is included in the bcc field.

bcc:

Example: 

• bcc:username1

Find messages where the given account is specified as the intended recipient of any replies.

replyto:

Example: 

• replyto:username1

Find messages with a given subject.

subject:

Example: 

• subject:secret-product-launch-plans

To search for multiple-word subjects, substitute a hyphen (-) for each space.

Find messages with a given Gmail label. 

label:

Example: 

• label:purchase-orders/approved

If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels. 

Note: searching for system-generated labels may return an excessive number of messages.

Find or exclude messages that have been removed from users' trash but haven't yet been expunged.

label:^deleted

-label:^deleted

Find or exclude messages that have been removed from user mailboxes because a retention rule expired.

label:^vault_deletion

-label:^vault_deletion

Find or exclude messages that have been quarantined. 

label:^admin_quarantine

-label:^admin_quarantine

Find or exclude messages sent with Gmail confidential mode. 

label:confidentialmode

-label:confidentialmode

Find messages sent to or from a group.

list:

Example: 

• list:company-announcements

Find a message based on the unique identifier of the group the message was sent to.

listid:

Example: 

• listid:employee-announcements.solarmora.com

List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and then click Original in the upper-right corner.

Find messages that are in a given folder.

in:inbox

in:spam

in:trash

Limit search results to classic Hangouts messages only (excludes Gmail messages).

is:chat

Find messages based on their status.

is:read

is:sent

is:starred

is:unread

Limit search results to messages that were successfully delivered to accounts.

deliveredto:

Example: 

• deliveredto:username1

Find only messages that have at least one attachment.

has:attachment

Find messages that include attachments with a given file name.

filename:

Example: 

• filename:secret-plans.pdf

This search term is case insensitive and supports partial matches and wildcards.

Find messages that include attachments with the exact file name you specify.

filename_exact:

Example:

• filename_exact:sEcReT-PlAnS.PdF

This search term is case sensitive.

Find message based on when they were sent or received.

sent_before:

sent_after:

received_before:

received_after:

Example: 

• sent_after:2017-12-16

Find messages older or newer than a given period of time.

older_than:

newer_than:

Example: 

• newer_than:1m

Supported periods of time include d (day), m (month), and y (year).

Find messages with a given attachment ID.

attachmentid:

Example: 

• attachmentid:f_g9bxf1o90

Find messages based on their size in bytes, including any attachments.

size:

Example: 

• size>=1000000

You can use :,<, >, =, <=, and >= with this operator.

Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments.

smaller:

larger:

Example: 

• larger:10M

Use K for kilobytes and M for megabytes.

Find messages based on a Message-ID.

rfc822msgid:

Example: 

• rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
Spjupgr1NZTiLGu16Z@mail.solarmora.com

Message-ID is a unique identifier for a message, added added by mail servers. Email clients and servers use this identifier to keep track of a message. You can view the Message-ID header by opening a message in Vault and clicking original.

Find messages with words near each other.

AROUND

Example: 

• tax AROUND 10 audit
• "secret AROUND 25 project"

Use the number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word.

This term can't be combined with a wildcard search and can't be used with parentheses or multiple-word phrases.

Find files that include 2 given search terms. 

AND

• Example: secret AND project
• Example: owner:username1 AND to:username2

Find files that include either of 2 given search terms (or both).

OR

• Example: secret OR confidential
• Example: type:(spreadsheet OR pdf)

Find files that do not include a given search term. 

NOT

• Example: NOT personal
• Example: username1 NOT type:image

Find files owned by a given account.

owner:

• Example: owner:username1

Find files shared by a given account.

from:

• Example: from:username2

Find files shared with a given account.

to:

• Example: to:admin@solarmora.com

Find files that users have marked with a star.

is:starred

Find or exclude files that users have moved to trash.

in:trash

-in:trash

Find a given file type.

type:

• Example: type:presentation

Supported file types:

• textdoc (Google Docs)
• spreadsheet (Google Sheets)
• presentation (Google Slides)
• drawing (Google Drawings)
• form (Google Forms)
• jam (Jamboard files)
• site (new Google Sites)
• document (all Google file types and PDFs)
• pdf
• image
• video

Find files based on when they were edited.

before:

after:

• Example: before:2017-12-31

Find files based on their title.

title:

• Example: ​title:secret product launch plans