Use operators to refine a search in Vault

Find messages that include 2 given search terms.

Examples:

• secret AND project (equivalent to secret project)
• from:username1 AND to:username2

Find messages that include either of 2 given search terms (or both). To ensure your query is processed correctly, use less than 20 OR terms in a query. If your query includes a date term, such as sent_before:, use less than 10 OR terms .

Examples:

• secret OR alert
• from:(username1 OR username2)
• "huge losses" OR "-1000%" (Note: Put quotation marks around terms that start with hyphens to ensure they’re not treated as NOT operators)

Find messages that do not include a given search term.

Examples:

• NOT personal
• from:username1 NOT to:username2

Find unknown or wildcard terms.

The wildcard (*) must appear at the end of a search term. For example, invit* returns messages with either invite or invitation (or both). However, *ation isn't supported.

You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain.

Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific.

Examples:

• invit*
• from:*@solarmora.com

Find messages with words near each other.

Enter a number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word.

Usage notes:

• AROUND can't be combined with a wildcard (*) search
• AROUND can't be used with parentheses or multiple-word phrases
• Use no more than 2 AROUND terms in a query.
• Set the AROUND distance to less than 20.

Example:

• tax AROUND 10 audit
• "secret AROUND 15 project"

Find messages that contain that word or phrase in the message text or subject.

To search for a phrase, put the words in double quotes (").

Example:

• alert
• "Solarmora, Inc." Note: Search ignores the case and punctuation of phrases in quotation marks. This example will also match solarmora inc and Solamora! inc.

Find messages with a given word or phrase in the subject.

To search for multiple-word subjects, substitute a hyphen (-) for each space.

Example:

• subject:secret-product-launch-plans

Find messages by Message-ID. Message-ID is a unique identifier for a message that is added by mail servers. Email clients and servers use this identifier to track a message. To get the Message-ID header, open a message in Vault and click original.

Example: 

• rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
Spjupgr1NZTiLGu16Z@mail.solarmora.com

Find messages received by a given account. The account can be a group email address.

Vault returns any messages that include the account in the to, cc, or bcc fields.

When you search accounts in your organization's domain, you don't need to specify the domain. For example, if your domain is solarmora.com, a search for to:sales is the same as a search for to:[email protected].

Examples:

• to:username1
• to:[email protected]

Find messages sent by the given account. Note:

• Gmail messages sent on behalf of the user by Google services, such as comment notifications from Drive, might not be included because only the user's name is reported, not their account username.
• In a Gmail search, a search for messages sent by a Google Group (for example, from:group@solarmora.com) returns messages only if a user subscribed to the group and gets abridged summary or digest emails. Notifications for every message are sent from the senders' individual accounts.

Examples:

• from:username1
• from:[email protected]

Find messages with the given account in the cc field.

Example:

cc:username1

Find messages with the given account in the bcc field.

Example:

• bcc:username1

Find messages with the given account as the intended recipient of any replies.

Example:

• replyto:username1

Find messages sent to or from a group.

Example:

• list:company-announcements

Find a message by the unique identifier of the group the message was sent to.

The List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and click Original in the upper-right corner.

Example:

• listid:employee-announcements.solarmora.com

Limit search results to Gmail messages successfully delivered to the given account.

Example:

• deliveredto:username1

Find or exclude messages with a given Gmail label. This operator isn't supported for messages in Google Groups.

If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels.

Examples:

• Find messages with a nested label

  label:purchase-orders/approved

• Find messages removed from Trash but not yet purged.

  in:trash AND label:^deleted

• Find messages removed from account mailboxes because a retention rule expired.

  label:^vault_deletion

• Exclude quarantined messages.

  -label:^admin_quarantine

• Find messages sent with Gmail confidential mode.

  label:confidentialmode

• Find messages waiting to be sent on a schedule 

  label:^scheduled

• Find messages that were sent on a schedule 

  label:^f_sd

• Exclude old versions of draft messages.

  -label:^r_ad

Note: If you search for a system-generated label, Vault may return an excessive number of messages.

Find messages in a given folder.

Examples:

• in:inbox
• in:spam
• in:trash

Find messages by type or status.

Options:

Find Gmail messages by status.

• is:read
is:sent
is:starred
is:unread

sent_before:

sent_after:

received_before:

received_after:

Find messages by when they were sent or received. Enter dates with the format YYYY-MM-DD.

Matches are inclusive of the specified date. For example, sent_before:2019-12-16 matches messages sent December 16, 2019 or earlier.

Example:

• sent_after:2017-12-16

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Example:

• newer_than:1m

Find messages by size in bytes, including any attachments.

You can use :, <, >, =, <=, and >= with this operator.

Example:

• size>=1000000

smaller:

larger:

Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments.

Use K for kilobytes and M for megabytes.

Example:

• larger:10M

Find messages with at least one attachment.

has:attachment

Find messages that include an attachment with the given file name.

The search term is case insensitive and supports partial matches and wildcards.

Example:

• filename:secret-plans.pdf

Find messages that include attachments with the exact file name.

This search term is case sensitive.

Example:

• filename_exact:sEcReT-PlAnS.PdF

For supported file types, find items that contain the given keywords or phrases.

To search for a phrase, put the words in double quotes ("). Case insensitive.

Example:

• alert
• "Solarmora, Inc."

Find items that include 2 given search terms.

Examples:

• secret AND project
• owner:username1 AND to:username2

Find items that include either of 2 given search terms (or both).

Examples:

• secret OR confidential
• type:(spreadsheet OR pdf)

Find items that do not include a given search term.

Examples:

• NOT personal
• username1 NOT type:image

Matches

• Files owned by the specified account.

Doesn't match

• Files previously owned by the specified account that transferred ownership to another account or to a shared drive.

Example

• owner:[email protected] matches files owned by user1. Doesn’t match files previously owned by user1 that are now owned by a different account.

Matches

• All files the specified account has permission to view, comment, or edit.
• Files the account owns.
• If the specified account has permission through a group membership:
  • If the group has less than 200 members, files shared with that group match the query.
  • If the group has 200 or more members, only files the account opened match the query.

• Files in folders where the folder was shared with the specified account, even if the file wasn’t shared directly.

Doesn't match

• Files in shared drives that the specified account is a member of, but that weren’t directly shared with the specified account.
• Files shared with a group before or after the specified account was a member.

Example

• sharedwith:[email protected] matches files that were shared with user1 either directly or through a small group that user1 belongs to.

Matches

• Files shared by the specified account with the accounts in the scope of the search.

Non-matches

• Files shared prior to March 2021
• Files shared by link (“anyone with the link can”).

Example

• from:[email protected] matches files that were shared by user1.

Matches

• Files shared by the accounts in the scope of the search directly with the specified account.
• If the specified account has permission through a group membership, matches the following files:
  • Files shared with the group (if the group has less than 200 members)
  • Files shared with the group that the account opened (if the group has 200 or more members)

  Note: Only files shared with the group while the account was a member are included.

Non-matches

• Files shared prior to March 2021
• Files in folders where the folder was shared with the specified account but the file wasn’t shared directly.
• Files in shared drives that the specified account is a member of, but the files weren’t shared with the specified account directly.
• Files shared with a group before or after the specified account was a member.
• Files owned by the specified account.

Example

• to:[email protected] matches files that were directly shared with [email protected]. Files that [email protected] has indirect access to through a shared drive don’t match.

Find items marked with a star.

is:starred

Find or exclude items moved to trash.

in:trash

-in:trash

Find items by type.

Example:

• type:presentation

Supported item types:

• audio
• document (all Google file types & PDFs)
• drawing (Google Drawings)
• form (Google Forms)
• image
• jam (Jamboard files)
• pdf
• presentation (Google Slides)
• site (new Google Sites)
• spreadsheet (Google Sheets)
• textdoc (Google Docs)
• vid (Google Vids)
• video

before:

after:

Find items by when they were edited. Enter dates with the format YYYY-MM-DD.

Matches are exclusive of the specified date. For example, before:2019-12-16 matches items edited December 15, 2019 or earlier.

Example:

• before:2017-12-31

Find items by title.

Example:

• title:"secret product launch plans"

Find messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for +tax doesn't return messages that contain "taxes".

Example:

• +secret +project

Exclude messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for -finance still returns messages that contain "finances".

Example:

• -personal

Find direct messages sent by a user and conversations the user participated in.

This operator requires the full account name, including your organization's domain.

Example:

• from:[email protected]

Find conversations that mention a given user.

This operator requires the full account name, including your organization's domain.

Example:

• at:[email protected]

before:

after:

Find messages based on when they were sent or updated.

Enter dates with the format YYYY/MM/DD.

Search uses UTC by default. Use the tz: operator to specify a time zone.

Matches are inclusive of the specified date. For example, before:2019/12/16 matches messages sent December 16, 2019 or earlier.

Examples:

• after:2018/11/21
• before:2019/03/16 tz:GMT-08:00

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Search uses UTC by default. Use the tz: operator to specify a time zone.

Example:

• older_than:1y

Specify a time zone for date- and time-based searches.

Specify the time zone with GMT+ or GMT- and the offset from UTC.

Example:

• older_than:1y tz:GMT-05:30

Find messages that include a specific type of content.

Example:

• has:video

Supported content types:

• file
• doc
• sheet
• slide
• url
• video
• pdf
• image

Search for only DMs or only messages in spaces. You can also search for messages in a specific type of space.

Options:

• is:dm (for DMs)
• is:room (for messages in spaces)
• is:threadedroom (for messages in threaded spaces)
• is:flatroom (for messages in unthreaded spaces)

Find text messages that include a keyword. If you enter a word with no search operator, Vault assumes message:.

Examples:

• message:alert
• alert

Find text messages, voicemails, and call logs that match two search terms. If you enter multiple search terms, Vault assumes AND between them.

Examples:

• secret AND project (equivalent to secret project)
• before:2020-01-31 AND with:+14155550132

Find text messages, voicemails, and call logs that match either of 2 search terms.

Examples:

• secret OR confidential
• with:(+14155550132 OR +14155550188)

Find text messages, voicemails, and call logs that do not include a search term.

Examples:

• NOT personal
• with:+14155550132 NOT with:+14155550188

Find text messages and call log events that involve a phone number, and voicemails from a phone number.

When you search by phone number, your entry must include:

• the plus sign (+)
• a country code
• the full number and area code

Example:

• with:+14155550132

Find text messages, voicemails and their transcripts, and call log events that occurred before or after a date.

Search is relative to 11:59 PM UTC-7 on the day the text message was sent, the voicemail was created, or the call was made or received.

Matches are exclusive of the specified date. For example, before:2019-12-16 matches messages sent December 15, 2019 or earlier. To run an inclusive search, enter values for the Date sent fields instead of entering these search operators in Terms.

Examples:

• before:2020-01-31

Find a specific type of data from Google Voice.

You can search for the following types:

• text_message—Text messages
• voicemail—Voicemail transcripts
• received_call—Call log events for answered incoming calls
• placed_call—Call log events for calls made
• missed_call—Call log events for unanswered incoming calls

Examples:

• is:text_message after:2020-01-01 with:+14155550132
• is:voicemail with:+14155550132

Find text messages that have an attachment.

Examples:

• has:attachment
• with:+14155550132 AND has:attachment