Use search operators
When you search in Google Vault, you can include search operators in the Terms field to narrow or broaden your search. Vault supports multiple operators, including:
- Boolean operators (AND, OR, and NOT)
- Gmail operators, such as to, cc, and bcc. You can use the wildcard operator (*) to search mail and groups messages. Use an asterisk at the end of a search term as a placeholder for unknown or wildcard terms. The wildcard operator is only supported at the end of a search term. For example, invit* returns both invitation and invite.
- Drive operators, such as type: and owner:
Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Refine your search to make it more specific.
- quotes to specify an exact phrase, such as "top secret widget".
- the hyphen (‑) to exclude whatever follows the hyphen. For example:
- Use apples ‑bananas to retrieve messages that mention apples, but not messages that include both apples and bananas.
- Use -in:trash to exclude files from Google Drive that are in the trash.
Search operator conventions
When you use search operators, keep the following in mind:
- Vault assumes there is an AND operator between search terms if no Boolean operator is specified.
- If you use a Gmail search operator, make sure you include a colon (:) immediately after the operator. Also make sure there are no spaces between the operator and the value—for example, to:username1
- When entering multiple values for the same operator, group them together in parentheses—for example, to:(username1 OR username2)
- Enter dates using the format YYYY-MM-DD
- Vault search is designed to find words and numbers. Don't search for punctuation marks or symbols.
List of search operators
Boolean operatorsBe sure to enter Boolean operators in all capital letters; otherwise, they will be treated as search terms instead of operators.
Note: Hangouts Chat doesn't support boolean operators.
| Operator | Description |
|---|---|
| AND | Searches for results that include both the term before and the term after the operator. For example:
|
| OR | Searches for results that include either the term before or the term after the operator (or both). For example:
|
| NOT | Searches for results that do not include the term after the operator. For example:
|
Mail and classic Hangouts search operators
These search operators apply only when searching for email messages.
| Operator | Description | Example |
|---|---|---|
| from: | The account that sent the message. | from:username1 |
| to: |
An account that received the message. The username can be in the To field or in the Cc field. The username can also be in the Bcc field in the account for which the Bcc is visible. Can also be used to search for group email addresses. |
to:username1 to:employees@solarmora.com |
| cc: | An account that was Cc'd on the message. | cc:username1 |
| bcc: | An account that was Bcc'd on the message. | bcc:username1 |
| replyto: | The account specified as the intended recepient of any replies to a message. | replyto:username1 |
| subject: | The subject of the message. If the subject includes spaces, substitute a dash (-) for each space. | subject:secret-message |
| label: | A label applied to the message. If the label name includes spaces, substitute a dash (-) for each space. The wildcard (*) is not supported. | label:urgent-requests |
|
label:^deleted
|
Deleted messages, which include messages that have been emptied from trash and messages removed by a retention policy. These messages are available for 30 days before they are expunged from all Google servers. |
label:^deleted |
| label:^admin_quarantine | Messages that have been quarantined. Add a hyphen to exclude these messages from your search. | -label:^admin_quarantine |
| label:confidential-mode | Messages sent with Gmail confidential mode. Add a hyphen to exclude these messages from your search. |
label:confidential-mode |
| list: | A group the message was sent from or to. | list:company-announcements |
| listid: | The unique identifier of a group the message was sent to. List-ID is a header included in messages sent to a group. You can view the List-ID header by opening a message and clicking original. | listid:company-announcements. solarmora.com |
| in:inbox | Returns only messages that are in the inbox. | in:inbox |
| in:spam | Returns only messages that are in spam. | in:spam |
| in:trash | Returns only messages that are in trash. | in:trash |
| is:chat | Returns only chat messages. Email messages matching your search terms are excluded. | is:chat |
| is:read | Returns only messages that have been read. | is:read |
| is:sent | Returns only sent messages. | is:sent |
| is:starred | Returns only messages that have been starred by users. | is:starred |
| is:unread | Returns only messages that are unread. | is:unread |
| deliveredto: | An account the message was successfully delivered to. Excludes failed deliveries. | deliveredto:username1 |
| has:attachment | Returns only messages that have at least one attachment. | has:attachment |
| filename: | Specifies the file name of the attachment. Supports partial matches and wildcard completion with the asterisk (*) character. Case insensitive. | filename:file.pdf filename:*.png |
| filename_exact: | Specifies the exact file name of the attachment. Case sensitive. | filename_exact:file.pdf |
| sent_before: | Returns only messages sent before the specified date. | sent_before:2010-12-16 |
| sent_after: | Returns only messages sent after the specified date. | sent_after:2010-12-16 |
| received_before: | Returns only messages received before the specified date. | received_before:2010-12-16 |
| received_after: | Returns only messages received after the specified date. | received_after:2010-12-16 |
|
older_than newer_than |
Use relative periods of time to search for messages. You can use d, m, and y for day, month, and year. | newer_than:2d |
| attachmentid: | Specifies the unique ID of an attachment. | attachmentid:f_g9bxf1o90 |
| size: | The total size of a message in bytes, including attachments. In addition to a colon (:), you can use <, >, =, <=, and >= with this operator. | size>100 |
|
larger: smaller: |
Similar to size: but allows abbreviations for numbers. | larger:10M |
| rfc822msgid: | A unique identifier for the entire message, added per RFC 822. If the application the message originated from did not add an ID, another server handling the message can add an ID as a way for client and server programs to keep track of the message. Message-ID is a header included in messages. You can view the Message-ID header by opening a message and clicking original. | rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl- Spjupgr1NZTiLGu16Z @mail.solarmora.com |
|
AROUND |
Syntax: wordA AROUND <1-50> wordB Returns messages that have wordA within a specified number of words (1-50) of wordB. Returned messages can have wordA either before or after wordB Add quotes to return only messages in which wordA appears before wordB. Can't be combined with a wildcard search. Can't be used with parenthesis or multiple-word phrases. |
don't AROUND 3 distribute "secret AROUND 25 project" |
Drive search operators
If you are searching for files on Google Drive, you can use the these search operators.
| Option | Description | Example |
|---|---|---|
| owner: from: |
Documents owned or shared from a specific person. | owner:username1 from:username1 |
| to: | Documents shared with a specific person. | to:username1 |
| is:starred | Items that have been marked with a star. | is:starred |
| in:trash | Items that are in trash. | in:trash |
| type: |
Search by type of document, such as:
|
type:spreadsheet |
| before:YYYY-MM-DD after:YYYY-MM-DD |
Find items that were edited before or after a certain day. | before:2014-05-01 after:2014-05-01 |
| title: | Search by the item’s title. | title:Conference 2014 |
Hangouts Chat search operators
If you are searching for messages in Hangouts Chat, you can use these search operators.
| Operator | Description | Example |
| from:
-from: |
Matches messages/topics that are sent/replied by this user. Must include the full account name with domain.
Use the hyphen (-) to match all messages/topics not sent/replied by the given user. |
from:jane@solarmora.com |
| has: | Returns only topics and messages that include a specific type of content:
|
has:video |
| at: | Returns topics that mention the given user. Must include the full account name with domain. | at:jack@solarmora.com |
| after: | Search for topics sent or updated after a given date. Dates are exclusive. UTC is used unless you specify a time zone | after:2017/11/21 |
| before: | Search for topics sent or updated before a given date. Dates are exclusive. UTC is used unless you specify a time zone. | before:2017/03/16 |
| older_than: | Search for topics older than a given time period (works the same as 'before:'):
|
older_than:1y |
| newer_than: | Search for topics newer than a given time period (works the same as 'after:'):
|
newer_than:1m |
| tz: | Add a time zone to before: and after: operators. Specify the time zone with GMT+ or GMT- and the offset from UTC. | before:2017/12/05 tz:GMT-05:30 |
| is: | Specify whether Vault should search DMs or rooms. | is:dm
is:room |
| +keyword
-keyword |
Match a keyword exactly. For example, a search for +banana won't return messages that mention "bananas".
Use the hyphen (-) to exclude the exact keyword. |
+confidential, -travel |
Was this article helpful?
How can we improve it?